I don't think there are any scenarios where a legitimate URL would end with those extensions, so it feels simpler to keep the check like this. Otherwise we have to find the route, since it could be /vfs or /api/vfs.