Improve Nginx config to prevent php injection in uri

First check if php script exists before calling php-fpm.
Add woff files to static download

This enables font downloading in binary mode.
Merge pull request #199 from oohlaf/fixes

Improve Nginx config