Tests now report HTTP status
Replaced server call to send_from_directory with send_file so security works