diff --git a/homeassistant/components/http.py b/homeassistant/components/http.py
index 7d8fd8620b4c8..89524ff931149 100644
--- a/homeassistant/components/http.py
+++ b/homeassistant/components/http.py
@@ -27,7 +27,7 @@
     HTTP_HEADER_CONTENT_LENGTH, HTTP_HEADER_CONTENT_TYPE, HTTP_HEADER_EXPIRES,
     HTTP_HEADER_HA_AUTH, HTTP_HEADER_VARY, HTTP_METHOD_NOT_ALLOWED,
     HTTP_NOT_FOUND, HTTP_OK, HTTP_UNAUTHORIZED, HTTP_UNPROCESSABLE_ENTITY,
-    SERVER_PORT)
+    SERVER_PORT, URL_ROOT, URL_API_EVENT_FORWARD)
 
 DOMAIN = "http"
 
@@ -207,6 +207,10 @@ def _handle_request(self, method):  # pylint: disable=too-many-branches
                               self.server.api_password or
                               self.verify_session())
 
+        # we really shouldn't need to forward the password from here
+        if url.path not in [URL_ROOT, URL_API_EVENT_FORWARD]:
+            data.pop(DATA_API_PASSWORD, None)
+
         if '_METHOD' in data:
             method = data.pop('_METHOD')
 
diff --git a/homeassistant/const.py b/homeassistant/const.py
index 349a820dfc1d0..4e3bf05eaa914 100644
--- a/homeassistant/const.py
+++ b/homeassistant/const.py
@@ -1,7 +1,7 @@
 # coding: utf-8
 """Constants used by Home Assistant components."""
 
-__version__ = "0.17.2"
+__version__ = "0.17.3"
 REQUIRED_PYTHON_VER = (3, 4)
 
 PLATFORM_FORMAT = '{}.{}'