shouldn't this use + so that at least one of the chars match?  Or are any of these fields allowed to be blank, but send as part of the request anyways?