Path-Normalization

A front proxy that did not URL-decode while the backend did, so percent-encoding the admin path walked straight past the access control. abl found it.