Comment by dharmab

It's a big deal since it will be visible in access logs in plaintext, so if the logs are compromised your users would be too.