serve static and media files more similar to mediathread defaults
api shouldn't be anonymous
fix some more static and url links