An allowlist protects the main admin hostname but a second hostname still reaches the same backend through another proxy chain

The edge policy works on the documented URL, yet another hostname bypasses it because the backend is still exposed through a different path.