Observed "/sap/admin/public/default.html" and "/sap/admin/public/index.html" in the wild. The index.hml page might be accessible unauthenticated.