uploaded assets are now strictly served through the files controller