POST to avoid including passwords in URLs