Yes. But URLs tent to be logged more than HTTP headers or payloads. Any L7 proxy can spit out requested paths and the password will be preserved in different places for long periods of time.