Deny by default access to URLs not explicitly mapped.