If we make this not implemented, then we push the security problem to the users.  Anyone wanting static resources will need to provide an implementation, and be careful to get the security right.

How about this:  the base implementation checks that the uri matches `r"^static/.*\.(jpg|jpeg|png|gif|js|css)$"` and throws a 404 otherwise.  This will solve the 99% case.  Subclassers will only have to override it if they have more exotic needs, either more resources to serve, or have those kinds of resources but want to keep them private.

Other extensions we might need to provide?  .ttf .eot .woff .svg .swf .mp3 .avi .pdf .jar ... yikes.