test.py fixes, security + static message

Now the server only serves files from the project directory that end in html, js, css, gif or png.
Also it sends proper error messages for forbidden/not found files.
heroku support
test.py heroku fix