closes #3608

inb4 all admin routes are publically visible

src/routes/index.js

@@ -100,7 +100,8 @@ module.exports = function(app, middleware) {
 	var router = express.Router(),
 		pluginRouter = express.Router(),
 		authRouter = express.Router(),
-		relativePath = nconf.get('relative_path');
+		relativePath = nconf.get('relative_path'),
+		ensureLoggedIn = require('connect-ensure-login');
 
 	pluginRouter.render = function() {
 		app.render.apply(app, arguments);
@@ -112,11 +113,9 @@ module.exports = function(app, middleware) {
 
 	app.use(middleware.maintenanceMode);
 
-	app.all(relativePath + '/api/?*', middleware.prepareAPI);
-	app.all(relativePath + '/api/admin/?*', middleware.isAdmin);
-
-	var ensureLoggedIn = require('connect-ensure-login');
-	app.all(relativePath + '/admin/?*', ensureLoggedIn.ensureLoggedIn(nconf.get('relative_path') + '/login?local=1'), middleware.applyCSRF, middleware.isAdmin);
+	app.all(relativePath + '(/api|/api/*?)', middleware.prepareAPI);
+	app.all(relativePath + '(/api/admin|/api/admin/*?)', middleware.isAdmin);
+	app.all(relativePath + '(/admin|/admin/*?)', ensureLoggedIn.ensureLoggedIn(nconf.get('relative_path') + '/login?local=1'), middleware.applyCSRF, middleware.isAdmin);
 
 	adminRoutes(router, middleware, controllers);
 	metaRoutes(router, middleware, controllers);