allowed_bypass_endpoints for all, including sitemap