Well check also the respective ICF service, maybe your Solution Manager system has also the newer XSRF protection described in SAP note 1617090.
The fact that sap-login and sap-password are removed from the URL indicate that they are either removed because of XSRF protection or a redirect.