The urls under /_ah/* are handled by GAE security