assets are now strictly served through FilesController