config.filter_parameters doesn't effect in-browser request dump

rails-3.0.0.beta2

I've got config.filter_parameters << :password in config/application.rb. It filters the password in the logs, as expected, however, it quite unexpectedly shows all of my colleagues my password in the browser:

Request

Parameters:

{"commit"=>"Sign in",
 "authenticity_token"=>"...............",
 "user"=>{"remember_me"=>"0",
 "username"=>"my_username",
 "password"=>"my_password"}}