Disallow all except /assets/ on static.*