iOS9 does not load insecure resources from a secure page (SSL/HTTPS)

This is not related to ATS. WebKit enforces a mixed content policy that disallows access to certain classes of "active" content (JS, CSS, etc) from being loaded over an insecure connection when the host page is being served over https.

If you examine your page in the Inspector you will see this being reported in the error panel.

---

Follow up: You can't turn off mixed content blocking. Allowing insecure CSS or JS reduces the security of the entire page to that of the least secure resource. The solution if you must load css/js over http is to load the entire page over http. That way the UI seen by the user correctly reflects the security of the content.

App Transport Security revised in iOS9 release. Now onwards your application is safe from un secure connection. And iOS forces to make secure connection. This can be conflict in your case.

From Apple documentation

If your app needs to make a request to an insecure domain, you have to specify this domain in your app's Info.plist file

So I think this can make an issue while loading .css file for web pages.

So give a try specify your domain in info.plist and check that .css files are loaded or not.

Edit:

---

Spotlight: You need to add more keys here in info.plist.

Look at this key NSThirdPartyExceptionAllowsInsecureHTTPLoads this allows a service domain which is not controlled by developer and add an exception to Transport layer to by pass insecure resources.

The structure for adding keys for App Transport Security is below:

For more details and explanation about all keys check this note - App Transport Security Technote

In your info.plist you need to add the following App Transport Security keys:

NSAppTransportSecurity                                      Dictionary
    NSAllowsArbitraryLoads                                  Boolean       YES
    NSExceptionDomains                                      Dictionary    
        **YOUR-DOMAIN-HERE**                                Dictionary
            NSExceptionAllowsInsecureHTTPLoads              Boolean       YES
            NSIncludesSubdomains                            Boolean       YES
            NSThirdPartyExceptionAllowsInsecureHTTPLoads    Boolean       YES

Hopefully this should work for you.