Comparison to allow urls without extension always failed

When the option 'force extensions' was set to false, the comparison in #allows always returned false, so it always returned a 404. The tests didn't reflect this, because it was not properly nested.