The policy is that all paths (added by the module) that the hosted user will access should start with that.