You're right, posts are a pain from a browser, and CAS is a pain from curl. We could change to a POST and just require devs to use the appropriate hacky browser extension (I know they exist) to hack the POST. 

For now, it doesn't bother me too much that it's a GET.