fix(webapp): hardened url matcher for authorized engine

see: https://github.com/camunda/camunda-bpm-platform/pull/83

related to #CAM-2421