web app manifest 302 redirects to protected branch auth page, when the environment is protected?

**Describe the bug**

Steps to reproduce the behavior:
1. Set a protected environment:

2. Login
3. Error in devtools:

4. Notice when loading resources, web manifest is loaded from static web app server with 302, from a different IP to other resources?

6. The app manifest content has become the HTML of the standard auth page of the protected branch!:

**Expected behavior**
web app manifest should load as any other resource on a protected branch, post-auth, with response 200 with the content that was set at build/deploy time.

When branch is not protected, the behaviour is normal (as expected). manifest file loads with no redirect and with the content that was set by development.

- OS: Windows
- Browser: Chrome & Firefozx

**Additional context**
Web app is a pre-compiled Blazor web assembly app, with both app build and api build skipped by Oryx.