And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any chang

And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any change, accidentally or maliciously. That is following inline with still-so Common Criteria guideline.