Update InternalBackend to send non-GET data in body.

The default backend currently passes all data in the URL query parameters. This isn't our recommended way of making non-GET requests and could interact badly with systems that e.g. assume URLs are always safe to log or assume URLs represent resources that can be safely retrieved. This PR changes InternalBackend to use a form-encoded HTTP body for non-GET requests.

r? @cosn