Disable access to all endpoints other than a few whitelisted ones.

- If authentication is enabled, and user is not authorized, dissallow access
  to all endpoints other than '/', '/authenticate', '/webadmin' and '/browser'