Re: XForms: urlencoded-post encoding wrong?

I read that document but I don't understand how it relates, and I think
something is being misunderstood here, most likely on my end.  So let
me just restate the problem I'm having.

I have a form, say on the domain foo.com, which contains an XForm.  The
XForm submits via method="urlencoded-post" to another domain, bar.com.
So far we're in the clear, this works fine.

But, if the method is changed to method="post", this generates a
security exception.

I don't understand what is different about these two approaches, or
what makes one more of a security breach than the other.  As far as I
know, this is a common practice in plain HTML forms, and allowed by the
XForms spec.

Is this a restriction because XForms support is added as a Mozilla
extension, rather than part of the core?

Eric