If you want to use authentication with a GET, the 'proper' way to do it is to use basic access authentication.
http://en.wikipedia.org/wiki/Basic_access_authentication
The client takes the username and password and forms a string of the form user:password. So in your example, that will be:
"xyz:234fsf34"
The client then base64 encodes this string. If the client is also Java, you could use the apache commons Base64 class for encoding/decoding:
http://commons.apache.org/codec/apidocs/org/apache/commons/codec/binary/Base64.html
So you get something like:
"eHl6OjIzNGZzZjM0"
And the client sends this in the GET, but as an HTTP Header (not Request Body):
GET /player/login/ HTTP/1.0
Content-Type: application/json
Authorization: Basic eHl6OjIzNGZzZjM0
The server reads this in the HTTP Header 'Authorization' much like the example code here:
https://cwiki.apache.org/WINK/jax-rs-http-headers.html
Then decodes it with the (Base64 apache commons class).
Then you can respond to the GET with appropriate data.