More TODO erasures. Plus found missing functionality

org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/FHIRToolingClient.java

@@ -362,10 +362,14 @@ public class FHIRToolingClient extends FHIRBaseToolingClient{
   }
 
   /**
-   * Helper method to prevent nesting of previously thrown EFhirClientExceptions
+   * Helper method to prevent nesting of previously thrown EFhirClientExceptions. If the e param is an instance of
+   * EFhirClientException, it will be rethrown. Otherwise, a new EFhirClientException will be thrown with e as the
+   * cause.
    *
-   * @param e
-   * @throws EFhirClientException
+
+   * @param message The EFhirClientException message.
+   * @param e The exception
+   * @throws EFhirClientException EFhirClientException representing the exception.
    */
   protected void handleException(String message, Exception e) throws EFhirClientException {
     if (e instanceof EFhirClientException) {
@@ -379,8 +383,8 @@ public class FHIRToolingClient extends FHIRBaseToolingClient{
    * Helper method to determine whether desired resource representation is Json or
    * XML.
    *
-   * @param format
-   * @return
+   * @param format the format
+   * @return true if the format is JSON, false otherwise
    */
   protected boolean isJson(String format) {
     boolean isJson = false;

org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/network/FhirRequestBuilder.java

@@ -51,7 +51,6 @@ public class FhirRequestBuilder {
   private ToolingClientLogger logger = null;
   private String source;
 
-  //TODO this should be the only constructor. There should be no okHttp exposure.
   public FhirRequestBuilder(HTTPRequest httpRequest, String source) {
     this.source = source;
     this.httpRequest = httpRequest;

org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/ManagedFhirWebAccessor.java

@@ -126,10 +126,9 @@ public class ManagedFhirWebAccessor extends ManagedWebAccessorBase<ManagedFhirWe
         }
         OkHttpClient okHttpClient = getOkHttpClient();
         //TODO check and throw based on httpRequest:
-        // if (!ManagedWebAccess.inAllowedPaths(url)) {
-        //      throw new IOException("The pathname '"+url+"' cannot be accessed by policy");
-        // }
-        //TODO add auth headers to httpRequest
+
+        if (!ManagedWebAccess.inAllowedPaths(httpRequestWithDirectHeaders.getUrl().toString())) {
+              throw new IOException("The pathname '"+httpRequestWithDirectHeaders.getUrl().toString()+"' cannot be accessed by policy");}
         Response response = okHttpClient.newCall(requestBuilder.build()).execute();
         return getHTTPResult(response);
       case MANAGED: