The username/password handling is just mocked currently.
The css file is built to a file with (short) checksum in the file name, to be nicely cacheable. The actual file name is compiled into the binary and sent to the templates as a variable.