Add TODO about fully qualifying assertion URLs.