A Cloudflare Access app is protected on 443 and an alternate admin listener remains public

A team puts an app behind Cloudflare Access and later discovers a side-channel admin port on the same origin is still reachable directly.