Serve static resources without loading feature user for security check (fixes #86)