Hiding serverargs userid and/or ifrun60 command line arguments

Question

I am running Forms 6i applications via the web using 6i Forms Services (on windows 2000). All my applications work properly.
Problem: How to secure the username and password (userid) when launching a form over the web.
The HTML that launches a Form on the web contains the 'serverArgs' parameter that contains all information required as seen here:
<PARAM NAME="serverArgs" VALUE="module=run.fmx userid=user/pass@SID">
I need to know how I can hide the userid. I need to log the user directly into the application because it is integrated with an existing servlet based application. What I don't want is the userid and password sitting in their browser cache - this is a major security problem. Is there a way of hiding/dealing with the password?
Here's another angle that might solve the same problem: I recall reading somewhere that the ifrun60 (or whatever your runtime is) has a command line upper limit of 255 or so characters. I also remember (I think) that you can avoid this problem by putting your arguments into a file that the forms runtime will read. Is this possible and if so, how is it done? I figure if this is possible, I can solve my initial problem by specifying a file to read the username/password from (located on the server) in the 'serverArgs' parameter (above). I am assuming of course that the serverArgs parameter expects the exact same inputs as that of the runtime.
Any information relating to either issue would be GREATLY appreciated.
Thanks,
Matt.

Answer 1

After reading into the changes in patchset 6, upgrading and expecting to use this functionality I was terribly disappointed. It seems that if I wanted to use the Servlets (that were included with patchset 6) to hide the userid and password, I need to install 9iAS!! What's the point? So the solution is to upgrade to forms 9i and that there is no solution for 6i.
Instead of installing 9i, I attempted to hack away at the jar's that included the servlets that would solve my problems. I managed to get them up and running (the servlets) without installing 9i but didn't finish making them launch Forms 6i programs themselves. I assume that it is entirely possible to do so, but you need to really know your way around an application server.
The answer to my question is that there is no way for Forms 6i (running on the 6i Forms Services) to properly hide the userid/password string. In 9i Forms Services, this is definately possible, but in order to run 9i Forms Services, you need to install 9iAS Enterprise Edition... In my case, 9iAS EE is way more than I wanted. It contains way too much extra functionality that I wasn't prepared to use and is way too large. Having Forms Services as a separate component (as it was in 6i) was a much better solution.
Matt.