You're right about the insecure attr. I added it now.

auth_url is supposed to be auth_uri it seems. And it's supposed to have the public url, while the other one forms the admin url.