Which file extensions are protected by .Net are set on the machine level. It seems our servers for Kiln On Demand were configured to allow those extensions, while yours is not. I've opened a bug and we'll make sure and get a fix out in the next update.
In the meantime, you add the following <fileExtensions> section under <security> in your Kiln/web.config to correct the problem:
<security>
<requestFiltering>
<requestLimits maxAllowedContentLength="2147483648" />
+ <fileExtensions>
+ <remove fileExtension=".cs" />
+ <remove fileExtension=".csproj" />
+ <remove fileExtension=".config" />
+ <remove fileExtension=".resx" />
+ </fileExtensions>
</requestFiltering>
</security>
(Obviously, exclude the +s.)
If you see any other 404s on specific file types, add them too.