The reserve/placerequest.pl web service does not do an authorization check, thereby allowing anybody to construct a URL that could place a hold request on any item on behalf of anybody else.
Pushed fix.