Should we return 404 if the route DOES match, but `forwarded` is `True`? That way an end user can never hit `/health`, for example, even if they auth. If we take that approach, then "whitelist" would no longer be the appropriate term. More like "restricted routes/paths".

It seems like this middleware could be used to block end-users from accessing "ops" endpoints not necessarily for the sake of security, but to avoid unnecessary traffic and load when the endpoint in question is expensive, such as if we were to implement some kind of a /health?deep=true check in the service.