A reverse proxy authenticates normal paths and leaks one admin endpoint

The route exists and auth is enabled, yet one encoded path variant reaches the backend before the final normalized path is checked.