If I add the following two lines to do NTLM Authorization:
response.setStatus(response.SC_UNAUTHORIZED);
response.setHeader("WWW-Authenticate", "NTLM");
Then form data past in form using POST is gone!
GETs still work, but the POSTs fail.
So how do undo the response...