A hardened proxy blocks normal admin verbs and one legacy WebDAV path still...

The visible route is protected, yet the internal rewrite escapes into a named location without the expected auth enforcement.