The jira-baseurl-plugin add it's own servlet to include some resources need to display popup "You are accessing JIRA from different url than your configured base URL". In order to do so it needs to check is user have system_admin permissions and if there is a mismatch between accessing url and configured URL. Problem is that this servlet runs for every request, including requests for resources which dramatically increase amount of global permissions checking.

Servlet configuration:

<servlet-filter key="baseurl-filter" class="com.atlassian.jira.baseurl.IncludeResourcesFilter" name="Base URL plugin filter" location="before-dispatch" weight="200"><url-pattern>/*</url-pattern><dispatcher>REQUEST</dispatcher><dispatcher>FORWARD</dispatcher></servlet-filter>