Should the createtoken be passed as part of the query string or in the POST body?

If you have time and could point me to the source code for the createaccount action I will examine it and see if I can discern what I should be passing in.