A Cloudflare Access policy looks correct and one API still returns 403

An internal API is moved behind a new Access application and only some users keep seeing 403 responses from a browser session that otherwise looks authenticated.