Just a suggestion. Since it IS a password getting hashed, maybe pass the values in the body instead of querystring.