bug: remove Authorization header for static file requests.