Clearly an HTTP security consideration, not HTML.
>2. The URL display field(s) provided my many user agents
Since when are URLs so sensitive that the user should't know the
address of the document s/he's looking at?
> Information providers should also be aware that some current user
> agents ignore the METHOD=POST specification and hence subject
> all sensitive information to the above risk.
Blech. Do they really? I don't want to put this in the spec. If
somebody feels strongly that it should be included, let me know.
Dan