Your suggestion seems utterly complicated to implement. I have tested the window.name and works perfectly well, I have already implemented it on 'trunk'... you will see the feature in the next release. The login form should set the window.name on submit, here is a silly sample:

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>test</title>
<script>
function setLogin(value){
    window.name=value;
    window.location='index.html';
}
</script>  
</head>

<body>
<form id="form1" name="form1" method="post" action="">
  <select name="select" onchange="setLogin(this.value)">
     <option>seleccionar</option>
    <option value="&exten=100&pass=qwop">Login with 100</option>
    <option value="&exten=101&pass=qwop">Login with 101</option>
  </select>
</form>
</body>
</html>

Any method that will remove the login credentials from the URL will be super

An alternative solution could be to make it possible to do the password check manually in the perl module, that way i could use the password field as a session hash and handle the session setup and expiry in my backend.

I will investigate if possible, and if its possible will include it on the next release.