We would like to be able to block /admin on the primary domains, for security purposes as that's most likely to get scanned/brute forced. However, /admin/account/canimpersonateuser needs to be able to work to impersonate. Please adjust the blocks to allow impersonation but block the rest on /admin