[FIX] js and css bundle controllers set as auth='public'