Actually use defensive static_path_url

The commit you already had defensively checked for whether `app.static_url_path` or `app.static_path` was the right one to use...and then promptly ignore that and went for `app.static_url_path` anyway.  This fixes the behavior to work with (comically old) Flask versions.