By default, bloodhound.js will query via HTTP GET, but that leaves you vulnerable to [JSON hijacking](http://haacked.com/archive/2009/06/25/json-hijacking.aspx/). Since I have sensitive information that I want to load into typeahead, HTTP GET leaves me vulnerable. There used to be an option for picking post (as shown here: [typeahead.js remote beforesend post data issue](https://stackoverflow.com/questions/18874121/typeahead-js-remote-beforesend-post-data-issue)), but that doesn't work with the latest version (v.0.11.1).