Fix isApiUrl() to work with expression-based Spring security.