Add #manta
Use express' static middleware for serving static files

This plugs a security hole.
Plug another potential security hole