assets: fix some missing url_for("static")

I didn't search well enough for all the occurences of `css` and `js` calls.

Bug reported by: @jalavik, related to: #219