Is there any good reason that the user registration form XWiki.RegisterNewUser uses GET (putting all form fields, including the password, into the URL's query string)? More to the point, is there any special reason that I can't or shouldn't change it to POST? brain[sic]