ban.url is confusing as it takes a regular expression rather than a
fixed string, so get rid of it in favour of people being explicit and
using ban req.url ~ /foo