An auth gateway protects a path and an encoded traversal still reaches the...

Both layers inspect the same URL textually, yet they normalize it in different orders and disagree on which route is protected.