* actually log an error when subpath rewrite fails * update subpath rewrite to accommodate dropping unsafe-eval