url userid password

I have a security problem. How to pass parameters in the url in a hidden way? I am wanting to spend already authenticated parameters of a system.

Working:
http://localhost:8080/pentaho/Home?u...sword=PASSWORD

But the parameters are visible: USER PASSWORD

Anyone ever had this problem? Know any way to solve?