anchor.diff:  
       public ServerUrl getConfigServerUrl(String uri) {
       	//if either uri or proxy.config don't end in a slash, lets add them (just for comparing)
  -        String slashedConfigUrl = null;       
  +        String slashedConfigUrl = null;    
           String slashedUri = uri;        
       	
       	if (!uri.substring(uri.length()-1).equalsIgnoreCase("/"))
       		slashedUri = uri.indexOf("?") == -1 ? uri + "/" : uri.substring(0, uri.indexOf("?")) + "/" + uri.substring(uri.indexOf("?"), uri.length());
  -    	
  +
           for (ServerUrl su : serverUrls) {
           	if(!(su.getUrl().substring(su.getUrl().length()-1).equals("/"))) 
           		slashedConfigUrl = su.getUrl() + "/";
  +        		
               if (
                   su.getMatchAll() && 
                   (isUrlPrefixMatch(su.getUrl(), uri) && (isUrlPrefixMatch(slashedConfigUrl, slashedUri)))
   				)
  +				
                   return su;
           }
           if (this.mustMatch)
  -            throw new IllegalStateException();
  +        	return null; //return null then send 403 forbidden
           else
           	return new ServerUrl(uri); //if mustMatch is false send the server url back that is the same the uri to pass thru     
       }
  
positive.code: java.util.logging.Level,
  java.text.SimpleDateFormat" %>
  
  <!-- ----------------------------------------------------------
  See https://github.com/Esri/resource-proxy for more information
  ----------------------------------------------------------- -->
  
  <%!
  public static class RateMeter {
  
negative.code:             }
          }
  
  		if (getConfig().getConfigServerUrl(uri)==null) _sendURLMismatchError(response);
          serverUrl = getConfig().getConfigServerUrl(uri);
          passThrough = serverUrl == null;
      } catch (IllegalStateException e) {
  