It looks like Feike's entry helped me.      # Enable extensions in non-public content directories, using a regular expression      /0041        {        /type "allow"        /extension '(css|gif|ico|js|png|swf|jpe?g|clientlibs|woff|woff2|tff|swf|svg|eot)'        }