Expecting params hash but getting a string (Rails)

Question

I have a typical signup form which has, for example, three fields: login, password, and email. We're using rails' form helpers, so we are expecting these to come to us in a hash named user.

Something close to what we'd expect:

Parameters: {"action"=>"new", "controller"=>"users", "user"=>{"password"=>"[FILTERED]", "login"=>"new_user_login", "email"=>"new_user_email"}}

We then do stuff like: params[:user].merge(SOME_HASH) # some other stuff we want to save into the user object

A few times a day we're getting "undefined method `merge' for String", and looking at those requests, the params are instead coming in as:

Parameters: {"action"=>"new", "controller"=>"users", "user"=>"login=new_user_login&email=new_user_email&password=[FILTERED]"}

params[:user], which we expect to be a hash, is coming in as a single query string, leading to the error.

Has anyone else seen this in their logs? It's coming from the same form as the others, and it's a valid POST with authenticity_token set, etc. And looking for that login in our DB, we found that the user retried the request and succeeded.

Could it also be at the fault of the browser? This individual was Firefox 3.6 on a Mac.