#2041 revisited

This is a spiritual successor to @zwn's #2041. This is different in that it replaces the complicated logic that'd prevent querying the DB by short-circuiting the authentication callbacks themselves when loading assets. #1969 set up all our assets to be served by the CDN so this is less of an issue, but it affects anyone that loads the old widgets (this happens to fix #2272).