Some of the Jenkins confic is static and can be injected as part of the initial page load e.g. the list of extensions (js-extensions) and config added in the clobal JS scope (as part of https://github.com/jenkinsci/blueocean-plugin/pull/405).

In Scope

• Add extensions to the global application config object
• Add security related "stuff" done as part of https://github.com/jenkinsci/blueocean-plugin/pull/405
• Update frontend to read extensions from this config object
• Please review how the extension points are cached and calculated

Notes
There is noticable flicker if there is an async loading of extension points (via http://localhost:8080/jenkins/blue/javaScriptExtensionInfo) after the webapp has loaded, ideally it would be loaded inside the main index.jelly, making the json available to avoid an extra round trip.