An auth_request chain protects the browser UI and one API path bypasses policy

A reverse proxy centralizes auth and later only API clients find a path that avoids the expected policy check.