One could expect that requests on assets like CSS, JS or images are purely "statically" delivered but it appears that their responses, sometimes, have a "Set-Cookie" header (which leads to a log out).