For example getting myApp/content/view/.bashrc gives an NPE. so does getting ~bashrc and some others. Not quite sure why. This should of course give a 404 not a server error with NPE. This is a security issue because of security audits and also because random scans that continually attack servers will use bad URIs, and we don't want zillions of NPE traces in our logs!