Clarify that the ``submit_url`` field is without authentication.