title: Safari and Chrome adding form values to URL
body: <p>Long story short: on Chrome and Safari only, values from a login form are <em>sometimes</em> pasted into the user's URL, even though the actual login is POSTed via AJAX.</p>
  
  <pre><code>http://my-site.example/?name=user&amp;pw=xxx&amp;challenge=b1be8ad7aac242...
  </code></pre>
  
  <p>It's been reported repeatedly and I've seen it happen myself, but have been unable to reproduce it myself, much less figure out what on earth is going on.  Here's what the login form boils down to:</p>
  
  <pre><code>&lt;form name="login"&gt;
    &lt;input type="Text" name="name"&gt;
    &lt;input type="password" name="pw"&gt;
    &lt;input type="hidden" name="challenge"&gt;
    &lt;input type="button" onclick='JavaScript:xmlhttpPost("/php/login.php")'&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>The actual POSTed request does not even contain the challenge parameter:</p>
  
  <pre><code>function xmlhttpPost(strURL) {
    if (window.XMLHttpRequest) {
      self.xmlHttpReq = new XMLHttpRequest();
    } else if (window.ActiveXObject) {
      self.xmlHttpReq = new ActiveXObject("Microsoft.XMLHTTP");
    }
    self.xmlHttpReq.open('POST', strURL, true);
    ...
    query = 'name=' + encodeURIComponent(name) + '&amp;pw=' + encodeURIComponent(hash) + '&amp;lpw=' + encodeURIComponent(legacy_hash);
    self.xmlHttpReq.send(query);
  }
  </code></pre>
  
  <p>And on successful login, the user is redirected back to the same page (= forced to reload) if and only if they have a different language setting from the default:</p>
  
  <pre><code>location.href = "http://" + location.host + location.pathname;
  </code></pre>
  
  <p>Any ideas?</p>