only match HTML requests

- assumes /foo is an html request
- assumes anything w/ an extension is an asset req
- tests
- also bumped minimatch and alchemist deps