Merge pull request #225 from holblin/master

Security issue (XSS in username)
Security Patch (Prevent password in URL)
Change create and change password for use POST requests.
This prevent to see password in apache log or in /server-status for example