client: use POST instead of GET