allow css override in portal branding

fixes #1491
I'm just wondering if we should be *forcing* the CSS to be refreshed each request. Couldn't we just leave it up to the browser?

Or to put it another way: could we keep this simple until the feature is requested?