I think that taking away "Prefix" makes it less clear, because it is a prefix check on the path. For example making this path safe:

/api/group/g:oae:oae-team

Implies this is safe as well:

/api/group/g:oae:oae-team/members

We can probably change it to exact match now as I didn't end up needing the prefix functionality like I thought I did (I thought we would make all of /api/auth/* safe), but it might hose us down the road as we won't be able to make any kind of dynamic path safe.