/mobs, /static, /records and /sourcemaps redirect request to /login and bypass proxy

Describe the issue Hi, I'm protecting my Openreplay self hosted instance behind Google IAP. Following the docs, I made the following endpoints publicly accessible: /ingest /ws-assist /api /v2/api /spots /mobs /sessions /static /records /integrations /sourcemaps /spot /script

The problem is, when a user, not authenticated to Google Workspace, directly access /mobs, /static, /records, and /sourcemaps, they get redirected to /login and completely bypass IAP/proxy. They can attempt to login as many times as they want, and if they get the right credentials, they can reach the portal.

OpenReplay Environment

• OpenReplay version: v1.27.6
• Cloud provider: GCP