Before authentication, the /mailbox/index page will redirect to the login page. After authentication, the /mailbox/index page will work.
Basically, the app rejects every request made before authentication and redirects them to the login page.
After authentication, the browser receives an authentication cookie and accepts requests that require authentication.