Logged In: YES 
user_id=714555

I have attached a patch that fixes this bug. It uses
os.path.normpath to normalise the path, and then checks that
the file to be served resides under STATIC_FILES (new
variable in the config) path. config.py in the templates are
patched to include this new variable.