Secure Variable in request body of an HTTP AAA server in APM

Is %{session.logon.last.password} the only secure variable parsed properly in request body?

The problem is that I have to create a set of parameters parsing the data that comes in the password field, bot only one of them is really secret. Maybe if I try to reuse the session.logon.last.password to store this secret data and use it in the request body. I will try it.