Comment 8 for bug 861854

The approach is a misuse of HTTPs uniform interface. If it's necessary for security reasons then so be it.

That said, I'm wondering if a better approach would be to simply encrypt the token in the URI for the purpose of logging. Or better yet (and I realize I'm setting the bar high here) encrypt and base64 the token before placing it in the URI. The caller's own token can be used as the shared secret for the encryption, since it will be encrypted anyway by the SSL.

We might use something like this: http://www.codekoala.com/blog/2009/aes-encryption-python-using-pycrypto/