Let me define scope and out-of-bounds paths up front

I want to exclude /admin/delete and my payment webhook from destructive testing. A short scoping form before the test starts would prevent a lot of grief.