only serve static assets from the bound filesystem root
updates to asset handling

> return status 404 instead of 401 when asset is outside of bound root
> use Java 7's NIO API for determining if static asset is within root
> always check the file is within the bound root when getting file from context
moving file root checking down one layer
added FileHandlingSpec to demonstrate context "file()" behavior
making the FileHandlingSpec null-value test a bit more specific
Updating Context docs to explain file()'s behavior
refactoring confusing wording in documentation
updating to make tests more explicit, and fixing incorrect assessment in documentation
Add ignored test for rendering null file object
updating documentation link for Context#file
Merge pull request #204 from danveloper/master

adjustments to filtering asset paths (#214)