Lesson of the day: Hidden form values are not hidden from the user, they just aren't plainly visible to the user on screen.

Never "hide" sensitive data in those hidden input fields.