Is this a bug?

Say with me:

1. All bugs are just unwanted features.
2. All bugs are just unwanted features.
3. All bugs are just unwanted features.

For your case, why is any url other than "https://base.example.domain/context-path/some-other-path/logout" and "https://base.example.domain/context-path/some-other-path/login" allowed to update auth cookies?

In my opinion, its definitely an unwanted behaviour.