for sake of selective cookie sends, ensured that static path does not have regular app path as prefix

... and rewriting on server set up so that content will still be found