serve browser clients straight out of node_modules without symlink indirection