Portlet form's POST method behaving like GET method

[bala24]

Hello,

I am using Jboss Portal 2.6.6-GA. I have a form in a portlet, that collects username and password from the user and sends it to the portlet logic to process it.

<form name="mainForm" action="<portlet:actionURL/>" method="POST">
 <INPUT TYPE=TEXT NAME=username SIZE=20>
 <INPUT TYPE=PASSWORD NAME=password SIZE=20>
 :
 :
</form>

When submitted, even though the form is sent using POST method, the form data is seen in the address bar of the browser, including the password that the user typed.

What I am seeing in the address bar is something like this:

https://myserver.com:443/portal/sec/portal/default/default/MyPortletWindow?password=somepassword&action=e&windowstate=normal&mode=view&username=myself

But I do not want the password or any other form data to be visible in the location bar. How can I prevent this? Any clues?

Thanks much in advance.
.Bala.