Ensure HTTP auth only catches admin pages and not resources or 404s.