Circulation managers will change their URLs pretty frequently, whether to add HTTPS support, to change hosting providers, or changing the library's short name. But we use the circulation manager URL as the unique identifier for a library, so there's no way to indicate that your URL has changed – you will appear to the registry as a brand new library, and you will probably run afoul of various uniqueness requirements.

However, upon registration a shared secret is created between library and registry. This shared secret can be used to guide a URL-change process that is secure and (in most cases) reliable:

1. library registers with registry using a shared secret that matches an existing library, but a previously unseen URL
2. registry runs all the basic checks – does the new URL have an auth document, etc
3. registry creates a Hyperlink on the library with rel="start", containing the new auth document URL
4. registry sends out a validation email to the integration contact email. "hey, someone tried to change the url of your circ manager, click here if it was you"
5. upon validation, the library.url is updated to the hyperlink.href and the hyperlink is deleted
6. then the auth document is re-imported as it would be in a normal registration step

This is not 100% reliable because it assumes the old integration contact email still works. If the circulation manager URL and the integration contact email change simultaneously, we'll have to address that case manually.

In step 1 I would prefer for the library to sign something with its shared secret rather than sending the actual secret over, but since we have to look up the library by its shared secret I think we need the secret itself.