POST -> POST-Redirect-GET

Using only POST breaks the Back button.

To fix, use POST-Redirect-GET.

Protect Session by HMAC.