And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any change, accidentally or maliciously.

That is following inline with still-so Common Criteria guideline.