Add option to exclude url patterns from requiring authentication

This adds the ability to provide an optional array of URL patterns to exclude from requiring authentication.  This allows whitelisting a status or health check endpoint.