Security scan reports a public admin route

A route looks protected in manual testing, yet a scan still reaches the admin path because one redirect or normalized path bypasses the auth requirement.