The convention is usually to serve the SPA via a CDN regardless of server side authentication and then have client-side routing prohibit users from rendering authenticated pages. This assumes data is authenticated/authorized within a server side api and no privileged information is in client-side code (it never should).

In angular this is usually achieved by watching for state/route change events and deducing whether or not a route should be redirected or allowed to progress based on the status of the currentUser.

It sounds a little hairy but in my experience there are ample resources detailing the process and realistically it's about ~30 LOC.