From your description, at least 2 requests are involved. One request takes the unauthenticated user to the login page. Together with URL variables. I would imagine that a second request then takes him - without URL variables! - from the login form to the form's action page, where his credentials are validated.
If so, then that is the expected behaviour. You could change it as follows. Enable session management, and implement the following on the login page:
<cfloop collection="#url#" item="myVar">
<cfset session[myVar] = url[myVar]>
</cfloop>
This results in ColdFusion storing the value of each URL variable as a variable of the same name in the session scope. Thus, the values of URL.x, URL.y, etc. will be stored, respectively, as SESSION.x, SESSION.y, etc.. You could then transfer the respective values from session back into URL scope in the links in later pages.