Matches Maestro issue # 202 - token authentication allowed on any direct url.