Invalid Auth Flow API endpoint returns CSRF error

**Describe the bug**
I tried a couple of wrong endpoints to see if /api/v1/ will return HTTP status code 404. For example, the following URLs returned CSRF errors instead:

- `/api/v1/authentication_flows/states/inputs` (correct endpoint is `/api/v1/authentication_flows/states/input` ends with **input** and not **inputs**)
- `/api/v1/authentication_flow` (correct endpoint is `/api/v1/authentication_flows` ends with **flows** and not **flow**)

**Authgear Version**
- Version: SaaS [or Date/Version]

**To Reproduce**
Steps to reproduce the behavior:
1. Open Postman
2. Create a new request to `/api/v1/authentication_flows`
3. Alter any character after `/v1/` such that you end up with an invalid endpoint.
4. See error

**Expected behavior**
Return 404.

**Screenshots**

**Client Env (if applicable, please complete the following information):**
- Device: [e.g. Desktop, Smartphone]
- OS: [e.g. Windows, iOS]
- Browser [e.g. chrome, safari]
- Browser Version [e.g. 22]

**Additional context**
Add any other context about the problem here.

Reproduce the behavior in Postman using the invalid paths `/api/v1/authentication_flows/states/inputs` and `/api/v1/authentication_flow`, then inspect the API routing and CSRF handling for these requests. Done means invalid `/api/v1/` endpoints return HTTP 404 instead of a CSRF error, with tests covering the behavior.

Written by the indexing model from the issue text.