I don't understand the point you're trying to make here, or the stridency with which you're making it. You in fact do know that the most popular web servers do log the URL, and do not log POST parameters or individual headers.
That's why professional security audits will ding you for putting anything sensitive in a URL.
That's why professional security audits will ding you for putting anything sensitive in a URL.