I think that it would be most helpful if you could provide more information about exactly how you have configured the various handlers ... and how, exactly, PHP apps are running in “the protected locations.” Since “authorization” is the last of three handlers (the others being Access and Authentication), and all of them (AFAIK ...) are particular to mod_perl which has nada to do with PHP, a more complete description of the complete setup is requested.

(Or did you simply “say PHP when you meant to say Perl?”)

I am also a bit confused by your reference to “environment.”   I ordinarily think of this term as referring to “environment variables,” versus the POST data-stream . . . and in any case I agree/think that, if something is bolluxing-up those [POST ...] variables, any one of the handlers could be doing it.