[paxys]

Especially since the request contains the user's (hashed) passwords. You definitely don't want to be holding that on the server for longer than necessary.