The confirmation template is at packages/acs-templating/resources/forms/confirm-button.*
It calls ad_conn url which returns /subsite/page even if we are operating from a mapped subsite. So the RP redirects to /page losing the POST vars when we come from a form.
