don't redirect to a GET with sensitive data, RT#26099