Resources should be rejected unless they match an allowlisted path.