don't redirect to a GET with sensitive data, RT#26099
don't redirect to a GET with sensitive data, RT#26099