Unprotected routes

[eliasmalik]

Both the reserve book and single book routes are unprotected, by which I mean there are no authentication checks in the handler (like you have in your library controller).

That means anyone can send a request to your server and reserve any book. This is probably an undesirable feature.