updates to asset handling

> return status 404 instead of 401 when asset is outside of bound root
> use Java 7's NIO API for determining if static asset is within root
> always check the file is within the bound root when getting file from context