Interestingly, this is shocking close to something we've been building for our internal dashboards. The only slight variation is that we serve the URLs of the J

Interestingly, this is shocking close to something we've been building for our internal dashboards. The only slight variation is that we serve the URLs of the JS from one of our backend services over CORS - because we want access to the code for the dash to be subject to authentication, so all our fraud controls etc aren't super easily visible. So if there's no valid auth, it goes to our `service-dashboard-asset` system and requests a URL for the login app - injecting the script tags into the page, then the user can authenticate. Then the page refreshes, the auth is present, and it goes to `service-dashboard-asset` and requests a URL for the actual dashboard, and now injects this script tag in instead.