Fix static file serving tests now that we've changed how static files are
served.

Some things that used to serve 403s now serve app HTML. Some paths with ..'s
that used to resolve to actual app resources now don't.