restore use of tornado static_url

instead of jinja macro that doesn't write hashes

closes #4714
don't raise 404 in get_absolute_path

raise in validate_absolute_path, where it belongs