The path must exist and not contain '/../' (traversal).

I am no 100% sure but I think we can only write the HTTP status
code once. So once the 200 is out, we might as well panic on errors.
The Go HTTP server will only let the goroutine crash, not the entire
server process.