Block vintage-traffic.com.
Unbreak the blacklist.

I guess Express just blindly returns a 403 if you pass a path containing
'../' to res.sendfile(), even if the resolved path is within the public
dir.
Make evil.css even more evil.
Remove #blowme from evil.js. Way too rude.
Just rotate the html element. Easy-peasy.