fixes error that is interpreting every h request as api request

Author: madoleary

h/security/policy/combined.py

@@ -88,7 +88,7 @@ def _call_sub_policies(self, method, request, *args, **kwargs):
 
     @staticmethod
     def _is_api_request(request):
-        return (request.path.startswith("/api") or request.path.startswith("/hypothesis")) and request.path not in [
+        return (request.path.startswith("/api") or request.path.startswith("/hypothesis/api")) and request.path not in [
             "/api/token",
             "/api/badge",
             "/hypothesis/api/token",