Put repeated auth URL in a class variable

...and added a TODO about the other ones. there seems to be conflicting
information here.

Also worth noting, UrlQuery will add the `?` if it's not present.