Add a spec for with_protected_env
Add a note on TM_ envvars