The HTTPS bicycle attack

As the article describes, unknown headers can be ignored by the attacker so that doesn't seem like a valid protection, but a _pad form field filled with letter a such that len(login) + len(password) + len(_pad) is constant might just work.

Then again, the POST data encoding is variable-length so this may still leak presence or absence of some special characters so padding and hex encoding seems like the best option.