When requesting material, the form asks for my library card number. I wasn't sure if this was optional (although in hindsight I don't think it had a red * next to it). In general I'm hesitant to disclose any "personal" information (yes, I know...this barely qualifies...but its a question of principle) using only an HTTP connection. You might consider using HTTPS at least for handling POSTS.