An access proxy protects the user API and one service path still bypasses MFA

The user path exists, yet normalization changes the evaluated route and the broader machine policy wins for one URL form.