I suspect the background is the app is showing html-views rendered on the server, and they are sharing as much infrastructure as possible. To make it easier on

I suspect the background is the app is showing html-views rendered on the server, and they are sharing as much infrastructure as possible. To make it easier on the app team. If they separated app/cdn/web with different SSL certificates, something like this wouldn't be possible even when developers eff up.