Which says that returning null from `getUrlName` is a tool to conceal the _existence_ of the resource named by the URL, by serving a 404. In this case the existence of `/selenium` is no secret, though anyone without `ADMINISTER` (or not logged in at all) cannot view it. So the original state—200 for users with `ADMINISTER`, 401 with login redirect for anonymous users, or 403 for authenticated users without `ADMINISTER`—is preferable to the state offered by this PR—200, or unexplained 404 for everyone else.