status endpoint shouldn't be under sso

instead, the nginx config restricts all access apart from localhost