Does this conform to http://tools.ietf.org/html/rfc7009#section-2.1? It looks like this is sending the params as a query string on the POST url as opposed to the request body. My understanding is that it will suffer from the vulnerabilities mentioned here http://stackoverflow.com/questions/323200/is-an-https-query-string-secure and also not meet rfc7009#s2.1.