fix(runtime): stop the /auth domain claiming every path that merely starts with auth

fix(runtime): stop the /auth domain claiming every path that merely starts with auth #21919