[undertow-dev] Unprotected areas still trigger auth