I think skipping this check is not a good idea. This makes sure that we only hand out files in the asset folder. The filename is given by a HTTP parameter so you can easily try to get for example the file "../../../etc/passwd"