Cloudflare Access protects the app generally and one cached path reaches the origin without identity headers

An origin trusts CF Access headers and later one static-like route starts reaching it without the expected identity context.