remove @url from public interface, allow constructor injection of location, make location protected