BUGFIX: allow static assets (avatars) for sites that require login