Vulnerability in Permit
Hi,

While reading [permit doc](https://github.com/ianstormtaylor/permit/blob/master/docs/guide.md#creating-permits) I noticed that sentence :

> This permit will check a request first for an Authorization Basic username and password, falling back to ?username=&password= query string parameters.

This is a big security flaw. You MUST NOT accept query string parameters (GET), but force the users to use POST parameters.
https://portswigger.net/kb/issues/00400300_password-submitted-using-get-method

Hope this helps !
Philippe
