fix(plugin-auth): the auth catch-all yields only a 404 that disclaims ownership

fix(plugin-auth): the auth catch-all yields only a 404 that disclaims ownership #10459