Would like to avoid using regex here if possible. Can we check indexOf === 0 for /api/auth and /api/user ?

Also, the way you bracketed the allowed URLs, it looks like the allowedUrls regex is allowing `^/api/auth` and `.*user/.*`, should probably be changed to: `new RegExp('^/api/(auth|user)/');` if we must use regexp. Also using the RegExp constructor makes it a little more readable.