[mistwang]

I am guessing that non-regexes are matched before regexes, which would always match against "/".

That's correct, explicit matching always takes place before regex matching. It is the current design.

Other than using three separate contexts (/css/, /img/, /ssi/) is there a better way to do the above?

Noop, at this point.
Actually, it should be faster than using regex matching.