Blazor WASM & Azure Static Web Apps, routes not working

I have a blazor WASM static web app, the "/api/" & "/.auth/" urls that should be handled on the server side by Azure seem to get pick up by the blazor WASM routing.

the "sorry, theirs nothing..." here is coming from App.razor:

<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(App).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
                <Authorizing>
                    <p>Loading session state...</p>
                </Authorizing>
                <NotAuthorized>
                    <h1>Sorry</h1>
                    <p role="alert">You are not authorized to access this resource.</p>
                </NotAuthorized>
            </AuthorizeRouteView>
            <FocusOnNavigate RouteData="@routeData" Selector="h1" />
        </Found>
        <NotFound>
            <PageTitle>Not found</PageTitle>
            <LayoutView Layout="@typeof(MainLayout)">
                <p role="alert">Sorry, there's nothing at this address.</p>
            </LayoutView>
        </NotFound>
    </Router>
</CascadingAuthenticationState>

for example if enter https://xxxxx/.auth/me in the browser I get the following:

But if I CTRL+F5 refresh then I can get the expected response:

I've tried the following without any luck in the staticwebapp.config.json:

  "navigationFallback": {
    "rewrite": "/index.html",
    "exclude": [ "/api/*", "/.auth/*" ]
  },

The exact same thing happens with the api paths, if go to the following url, i get "Sorry, there's nothing at this address." if I CRTL+F5 I get the response from the function, if I then click the browsers refresh button back to "Sorry, there's nothing at this address.", only way to get correct response if via CTRL+F5