OK, looks like I found the answer (at least I found a similar problem mentioned, tried their fix and it stopped falling):
the express.static middleware must be the last in the chain
express.static