The only URLs that should be available without authentication at all times are the `/-/static/` prefix, to allow for HTTP caching.