remove HTTP auth from images, JS and CSS to avoid a race condition on iOS
devices that causes spurious authentication popups