Disable `user_loading` on arbitrary endpoints

To be dealt with after #370.

For some reason, loading an asset while being logged in (i.e., being handled by the `static` endpoint) triggers the user loader, causing a lot of API calls – but there should be None, we don't need any information about the user when serving, say, a `.css` file.

There should be a (regression) test for this, as this has a significant performance impact.