fixed dashboard

the introduction of special bags[1] resulted in erroneous 404s due to the
"assets" bag being checked by `_ensure_wiki_readable`[2]

the fact that this utility function may raise both ForbiddenError and
HTTP404 seems like a symptom of badly mixed levels of abstraction, but
I'm not currently sure whether/how to resolve that - perhaps @cdent has
an opinion?

note that this required significantly altering the test infrastructure,
spawning an instance to create the "assets" bag and thus requiring
`remotes`

[1] cf. 9fb7efc629e8621199477f17f50312ca88f63a0d - untested at the time
[2] not sure why this issue wasn't encountered in manual testing but
    only when spawning an instance as part of the tests - which leaves
    me a little paranoid that perhaps I'm misinterpreting what's going
    on here