added a reminder (TODO) to enable the protected resource URL to be provided at run time.