distinguish metrics between legit and bot endpoint

[kcajmagic]

currently metrics return 301, and 404 for all request to the primary port. It would be nice to have a way to distinguish which route is being used or only record metrics for routes that are used.

[JC000]

More importantly, we should distinguish unauthorized bot access by return a 403 for these requests regardless of the path of the request. This is also a good security practice to prevent data leaks. An attacker would be able to tell the difference between a "good" versus a "bad" URL.