There's no good reason to bootstrap the UI within the browser using an
inline script tag rather than a separate dynamically created bootstrap
script.

Having this bootstrapping logic in its own file allows us to cache this
separately from the main HTML payload, and it is required if we want to
disable inline scripts entirely.

We do not require auth for the rest of our static JS files, and this
file should not be treated differently than those. That this file is
created dynamically rather than pulled directly from the file system
is just an implementation detail.