White-listing paths seems too inflexible to mee. What if extensions add their own routes?