...
At the hosting layer (AWS VPC), requests from outside the VPC to any url not in the /public prefix will return a 404. This will be enabled by default on all new IDAs, and will be rolled out on existing IDAs as teams have the bandwidth to adjust their URLs.
In order to make OpenEdX deployment easier, IDAs should continue to use correct authentication and authorization for all URLs.