Get the spyware url from tmc courses.json

[jamo]

Now hard coding the url and not asking it from sever makes it more fragile for architectural changes. And more importantly developers must know irrelevant deployment details