I notice that some of the .xml scenarios you have established try to use a "jscripts.js" file. Is your browser tripping up on that one? (The offending URL is shown below the 403 message). If so, then yes, that file extension is not (yet) on the permitted list.
Any others we need to add while I'm at it? We already have .htm,.html,.png,.jpg,.xml,.xsl, and .css
I'll add .m3u and .js to the list. Do we also need .class, and are there any others?
And what mime-type (Content-Type) applies to .js files?
Thanks