Security Patch (Prevent password in URL)

Change create and change password for use POST requests.
This prevent to see password in apache log or in /server-status for example