diff --git a/auth/handlers/handle_change-password.go b/auth/handlers/handle_change-password.go
index cf1e7957d..bed131389 100644
--- a/auth/handlers/handle_change-password.go
+++ b/auth/handlers/handle_change-password.go
@@ -10,7 +10,7 @@ import (
 func (h *AuthHandlers) changePasswordForm(req *request.AuthReq) error {
 	h.Log.Debug("showing password change form")
 	req.Template = TmplChangePassword
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	return nil
 }
 
diff --git a/auth/handlers/handle_login.go b/auth/handlers/handle_login.go
index e87939e38..423a48835 100644
--- a/auth/handlers/handle_login.go
+++ b/auth/handlers/handle_login.go
@@ -17,7 +17,7 @@ type (
 
 func (h *AuthHandlers) loginForm(req *request.AuthReq) error {
 	req.Template = TmplLogin
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	return nil
 }
 
diff --git a/auth/handlers/handle_mfa.go b/auth/handlers/handle_mfa.go
index cb45a299a..ad6fdcdd9 100644
--- a/auth/handlers/handle_mfa.go
+++ b/auth/handlers/handle_mfa.go
@@ -30,7 +30,7 @@ func (h AuthHandlers) mfaForm(req *request.AuthReq) (err error) {
 		req.RedirectTo = GetLinks().Mfa
 	}
 
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	req.Data["emailOtpDisabled"] = req.AuthUser.DisabledEmailOTP()
 	req.Data["emailOtpPending"] = req.AuthUser.PendingEmailOTP()
 	req.Data["totpDisabled"] = req.AuthUser.DisabledTOTP()
diff --git a/auth/handlers/handle_mfa_totp.go b/auth/handlers/handle_mfa_totp.go
index 3f8419736..539096f41 100644
--- a/auth/handlers/handle_mfa_totp.go
+++ b/auth/handlers/handle_mfa_totp.go
@@ -43,9 +43,8 @@ func (h AuthHandlers) mfaTotpConfigForm(req *request.AuthReq) (err error) {
 
 	req.Data["secret"] = secret
 	req.Data["enforced"] = h.Settings.MultiFactor.TOTP.Enforced
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	req.Template = TmplMfaTotp
-	req.SetKV(nil)
 	return nil
 }
 
@@ -154,9 +153,8 @@ func (h AuthHandlers) mfaTotpConfigQR(req *request.AuthReq) (err error) {
 //
 // Where the TOTP QR & code are displayed and where
 func (h AuthHandlers) mfaTotpDisableForm(req *request.AuthReq) (err error) {
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	req.Template = TmplMfaTotpDisable
-	req.SetKV(nil)
 	return nil
 }
 
diff --git a/auth/handlers/handle_password-reset.go b/auth/handlers/handle_password-reset.go
index c524ec3dd..2df4f2d0a 100644
--- a/auth/handlers/handle_password-reset.go
+++ b/auth/handlers/handle_password-reset.go
@@ -11,7 +11,7 @@ import (
 func (h *AuthHandlers) requestPasswordResetForm(req *request.AuthReq) error {
 	h.Log.Debug("showing request password reset form")
 	req.Template = TmplRequestPasswordReset
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	return nil
 }
 
@@ -73,7 +73,7 @@ func (h *AuthHandlers) resetPasswordForm(req *request.AuthReq) (err error) {
 		})
 	}
 
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	return nil
 }
 
diff --git a/auth/handlers/handle_profile.go b/auth/handlers/handle_profile.go
index a21f26c69..789b7bf38 100644
--- a/auth/handlers/handle_profile.go
+++ b/auth/handlers/handle_profile.go
@@ -10,9 +10,8 @@ func (h *AuthHandlers) profileForm(req *request.AuthReq) error {
 	req.Template = TmplProfile
 	u := req.AuthUser.User
 
-	if form := req.GetKV(); len(form) > 0 {
+	if form := req.PopKV(); len(form) > 0 {
 		req.Data["form"] = form
-		req.SetKV(nil)
 	} else {
 		req.Data["form"] = map[string]string{
 			"email":  u.Email,
diff --git a/auth/handlers/handle_signup.go b/auth/handlers/handle_signup.go
index 5b6befcb7..94cef8b67 100644
--- a/auth/handlers/handle_signup.go
+++ b/auth/handlers/handle_signup.go
@@ -9,7 +9,7 @@ import (
 
 func (h *AuthHandlers) signupForm(req *request.AuthReq) error {
 	req.Template = TmplSignup
-	req.Data["form"] = req.GetKV()
+	req.Data["form"] = req.PopKV()
 	return nil
 }
 
diff --git a/auth/request/context.go b/auth/request/context.go
index f7f46bb35..cf1627014 100644
--- a/auth/request/context.go
+++ b/auth/request/context.go
@@ -122,6 +122,12 @@ func (req *AuthReq) SetKV(val map[string]string) {
 	}
 }
 
+func (req *AuthReq) PopKV() map[string]string {
+	val := req.GetKV()
+	req.SetKV(nil)
+	return val
+}
+
 func ExtraReqInfoMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), ExtraReqInfo{}, ExtraReqInfo{