Instead of adding `/client` in the white list, we isolate it out to check if the path starts with `APP_PREFIX/client` so then client will bypassed but not `/api/clients`