Setting a conditional breakpoint for aura.css in RequestMatcherDelegatingAuthorizationManager , it is strange to see that the matcher for the stylesheet ends up being ‘any request’. I would have thought that the Vaadin static resource matcher or something would get to decide here.
