The listen path is /v1/ so everything under /v1/ will be proxied, the white list should stop anything else from getting through except /events though.
It could be the slashes though, can you try removing the leading slashes from your path definitions (events and events/*).