Systems should take care to ensure that sensitive data is not viewable in a user's browser history.
All form submissions should use a POST request.