Why can't I hide passed parameters?

You could always use a button_to and POST it to the server.