How to hide user form data in Request Payload

I am submitting a form by using "POST" method. But, even when I submit the form using "POST" method, I can see the submitted form data in http headers(Request Payload). I'm also using crypto to hash the password. This is the same login system I have deployed to heroku Simple Login System

Request Payload ScreenShot

This is my backend User Model

const mongoose = require('mongoose')
const crypto = require('crypto')

const userSchema = new mongoose.Schema({
    username:{
        type : String,
        max : 32,
        trim : true,
        required :  true,
        unique : true,
        index : true,
        lowercase :true
    },
    name:{
        type : String,
        max : 32,
        trim : true,
        required :  true
    },
    email:{
        type : String,
        trim : true,
        required :  true,
        unique : true,
        lowercase : true
    },
    profile:{
        type : String,
        required :  true,
    },
    hashed_password:{
        type : String,
        required :  true,
    },
    salt : String,
    about :{
        type : String
    },

    role :{
        type: Number,
        default : 0
    },

    photo:{
        data : Buffer,
        contentType : String
    },
    instagram:{
        type: String
    },

    resetPasswordLink : {
        data : String,
        default : ''
    }
},{timestamp : true})


    userSchema.virtual('password')
            .set(function(password){

        //create a temporary variable called _password
           this._password = password;

        //generate salt
            this.salt = this.makeSalt()

        //encrypt password
          this.hashed_password = this.encryptPassword(password)


    })

        .get(function(){
            return this._password;
        })

        userSchema.methods = {

            authenticate: function(plainText){
                return this.encryptPassword(plainText) === this.hashed_password; 
            },



            encryptPassword :function(password){
                if(!password) return ''

                try{
                    return crypto.createHmac('sha1',this.salt)
                                    .update(password)
                                    .digest('hex')
                }
                catch(err) {
                    return ''
                }
            },


            makeSalt : function(){
                return Math.round(new Date().valueOf * Math.random() + '');
            }
        }



module.exports = mongoose.model('User',userSchema);

Controller Method

const shortId = require('shortid')
const jwt = require('jsonwebtoken')
const expressJwt = require('express-jwt')



exports.signup = (req,res) => {
        User.findOne({email: req.body.email}).exec((err,user)=>{
            if(user) {
                    return res.status(400)
                    .json({ error : 'Email already exist'})
            }

            const { name, email, password } = req.body
            let username = shortId.generate()
            let profile = `${process.env.CLIENT_URL}/profile/${username}`

            let newUser = new User( { name, email , password, profile, username })
            newUser.save((err,success)=>{
                if(err){
                    return res.status(400)
                    .json({error: err})
                }
                // res.json({
                //     user:success
                // })
            res.json({ message: 'Signup Success ! Please return to the Login page' })
            })
        })
};



    exports.signin = (req,res) =>{

        const { email,password } = req.body;
            // check if user exists
            User.findOne({ email }).exec((err,user)=> {
                if(err || !user ){
                    return res.status(400).json({
                        error : 'User with that email does not exist,Please Sign Up'
                    });
                }

                 // user authentication
                 if(!user.authenticate(password)) {
                    return res.status(400).json({
                        error : 'Email and password do not match'
                    });
                 }

                 // generate a token and send to client
                 const token = jwt.sign({ _id: user._id},process.env.JWT_SECRET, {expiresIn : '1d'} )

                 res.cookie('token',token, { expiresIn:'2d' })

                 const { _id, username, name, email, role } = user;

                 return res.json({
                     token,
                     user : { _id, username, name, email, role }
                 })

            });

    }


    exports.signout = (req,res)=> {

        res.clearCookie("token")
        res.json({ message: 'Successfully Signed Out' })
    }