tiles was serving the wrong url; it forgot /vsafe/