Trouble serving static files when behind NGINX
for my `staticDirs` I've got ``staticDirs = "static", "static/fonts", "static/img", "static/css", "static/js"

I've got, for example, a font at the following path `/static/fonts/CopperplateGothicLightRegular.ttf`

The page sets this up in the `<style>` section with:
```css
  @font-face {
    font-family: CopperplateGothic;
    src: url("static/fonts/CopperplateGothicLightRegular.ttf");
  }
```

But when the page loads, I'm getting this:
```
GET /static/fonts/CopperplateGothicLightRegular.ttf
[HTTP/2 403 Forbidden 162ms]

downloadable font: download failed (font-family: "CopperplateGothic" style:normal weight:400 stretch:100 src index:0): status=2147746065 source: /static/fonts/CopperplateGothicLightRegular.ttf
GET/static/img/favicons/android-icon-192x192.png
[HTTP/2 403 Forbidden 0ms]
```

NOTE: NOT ALL STATIC FILES FAIL. Some of the static files work fine, such as a logo image in `/static/img`, and others. :confused: 

my nginx config:
```
upstream test-site.com {
  keepalive 100;
  server 127.0.0.1:8000;
  #server unix:/tmp/tsite.sock;
}

server {
  server_name test-site.com test-site.net;
  listen 443 ssl http2 default_server;
  listen [::]:443 ssl http2 default_server;
  
  # Serve static files if found, otherwise proxy to tsite
  location / {
    root /var/www;
    try_files $uri @tsite;
  }

  location @tsite {
    proxy_pass http://$server_name;
    # Allow fast streaming HTTP/1.1 pipes (keep-alive, unbuffered)
    proxy_http_version 1.1;
    proxy_request_buffering off;
    proxy_buffering off;
    # Proxy forwarding (password configured in app.config.FORWARDED_SECRET)
    proxy_set_header forwarded "$proxy_forwarded;secret=\"gg4A92ZFWfTLLU\"";
    # Allow websockets
    proxy_set_header connection "upgrade";
    proxy_set_header upgrade $http_upgrade;
  }
    ssl_certificate /etc/letsencrypt/live/test-site.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/test-site.net/privkey.pem; # managed by Certbot
}

# Redirect all HTTP to HTTPS with no-WWW
server {
    if ($host = www.test-site.net) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    if ($host = test-site.net) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

  listen 80 default_server;
  listen [::]:80 default_server;
  server_name ~^(?:www\.)?(.*)$;
  return 301 https://$1$request_uri;
}

# Redirect WWW to no-WWW
server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name ~^www\.(.*)$;
  return 301 $scheme://$1$request_uri;
    ssl_certificate /etc/letsencrypt/live/test-site.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/test-site.net/privkey.pem; # managed by Certbot
}
```

any ideas?