This actually hasn't come up before, typically Galaxy's static/ directory is readable. I've updated the docs with this information, however.

Yeah, /home/galaxy was only accessible by the galaxy user. I didn't realize this until looking in the apache logs. This may just be my site installation of ROCKS...