don't load js files that do not exist
change temporary cookie secret for dev
fix rewrite rule to grant access to public assets