EDIT: Looks like Techie-Micheal beat me to what I was typing, and explained it better too! Here what I had anyway... Isn't the sensitive info, whatever that might be, only transferred when the form is submitted ? It is usually only one way is it not? Because if you are an admin and someone intercept...