use POST method for credentials

As suggested by Bruno Renié from feedHQ.org, so that username/passwords do not appear in clear in the server's logs.