URL parameters will be encrypted with HTTPS, so they're not plaintext over the wire. The problem is that requests are usually getting logged somewhere, so anyone with access to the logs can see your password.