Hardcoded image link causes password request

The latest upgrade added two new files (profiles/openpublish/modules/features/openpublish_article/openpublish_article.box.inc and profiles/openpublish/modules/features/openpublish_general/openpublish_general.box.inc) which define, respectively, openpublish_article_default_box() and openpublish_general_default_box(). Both boxes contain a hardcoded link to http://jcaldwell.openpublish.dev6.fayze2.com/profiles/openpublish/images..., which is behind http password protection. As a result, editors working on the site are presented with an http authorization box for jcaldwell.openpublish.dev6.fayze2.com. I am deleting both boxes and the references thereto, but this should be somehow fixed in the distro.