Invalid use of * should be rejected

A path such as */config is accepted as valid but is actually treated the same as * which means all site-wide pages. That's misleading. Those paths should be rejected with an appropriate error message.