thanks for all your help. hossman is exactly right, it's not sensitive data but merely the equivalent to building a watch that doesn't expose the clockwork. hmm, i will conclude from your various comments that there is no straight solution per se. any option that is not 100% compatible is out (javascript, 307 redirect etc..) i'm now thinking to go with LWP::Agent after all using the forwarded url, even though it will not actually forward, the results seem to be the same:

  require LWP::UserAgent;
  $ua = LWP::UserAgent->new;
  my $req = HTTP::Request->new(POST => $forwarded_url);
  $req->content_type('application/x-www-form-urlencoded');
  $req->content($parameters_from_input);
 
 my $res = $ua->request($req);
 print "Content-type: text/html\n\n";
 print $res->content;
  exit;
[download]

Only thing is, i remember reading somewhere that there might be some problems with headers and cookies etc. I'm testing it right now and cant see anything obvious. Caution flags anyone?