encrypted passwords, post instead of get