Assuming "pluginId" property is set to "newplugin-backend", I think you should remove "/api/newplugin-backend" from "path" value like so:

httpRouter.addAuthPolicy({ path: '/applications', allow: 'unauthenticated', });