Once the URL is "learned", the credentials will continue to be sent. Replicate that with query strings... Edit: Thanks for deleting instead of just admitting y

Once the URL is "learned", the credentials will continue to be sent. Replicate that with query strings... Edit: Thanks for deleting instead of just admitting you were, in this case, wrong. The comment here that I originally replied to called me wrong and said that query strings are equally efficient for this purpose.