Mention authentication exception for static file serving.

doc/MANUAL.md

@@ -1077,6 +1077,8 @@ Scriptform does not provide the browser with a content-type of the file, since
 it is impossible to guess.  Generally, browsers do a decent job at figuring it
 out themselves.
 
+**Note**: Static file serving does not require authentication. All users,
+including anonymous users, can view static files.
 
 
 

src/webapp.py

@@ -478,7 +478,6 @@ class ScriptFormWebApp(RequestHandler):
 
     def h_static(self, fname):
         """Serve static files"""
-        username = self.auth()
         form_config = self.scriptform.get_form_config()
 
         if not form_config.static_dir: