Static Assets should not be Subject to Security

Apparently, the static assets needed for the login screen can only be accessed after the login:

I assume that this was introduced in a change to the SecurityConfig.java in 822aabed (here).