The Mac add-in is being periodically updated via the web so you don't need to install a new version. Invalid username or password error usually means that the add-in is not able to login to SugarCRM on behalf of the user. It could be that the password on Sugar has expired and is forcing you to change.
We were able to access your instance. Of course, we received an "Invalid User name/password" screen but that means that CORS is enabled. Can you please do the following:
Try logging in with incorrect user name/password. If you get the same error screen - that means that you can verify on your end that CORS is enabled. If not, that means that there is a network connectivity issue (firewall, proxy etc.) on your end that's blocking the request. Try accessing from a different location.
If you get the "Invalid User name/password" for incorrect user name/password but you still get the "No CORS" screen after logging in with correct credentials - that means that after login there is a re-direction to another location that doesn't have CORS (we've seen a customization that behaves like that).
