I can't get it replicate at all on any browser. I suspect it has to do with cookie handling... I've got it set to all paths but who knows what witchcraft is going on. The logic all looks right.

Point is moot though, since those strange paths should generate 404 headers and accompanying error page. Done!