Make all static assets internal

[m-barthelemy]

This would allow the app to be 100% self-contained and have a strict content security policy.
Also helps using it in very restricted network environments.