Move all assets to public/ folder and make app serve only public assets (it was possible to request any file)