Static serving routes through a pure resolve(), so the extension allowlist and the traversal guard are tested without aiohttp. modules/ serves .js only: a module cannot ship a stylesheet even if one is written.
