As it is to serve as an example rather than a commercial app, some areas have been ignored. However, these are essentially refinements, and do not affect the system architecture:
No security will be implemented for credit card purchasing. (HTTPs would be used in a real app, but the details of setting this up vary between J2EE servers).