Here's my setup ..

user
user/*
user/*/edit
admin
admin/*
cart/checkout
cart/checkout/review
cart/checkout/payment_details/*
cart/checkout/complete
uc_paypal/ipn/*
uc_paypal/wps/*
uc_paypal/wps/complete/*
cgi-bin/webscr

Wanted to keep all transaction and user information on the secure side, including stuff going out and coming back from PayPal IPN. Hope this helps some. (Probably not a definitive list but it's working for our site at this point.)