Mobile Access is considered a Remote Access product, so let's put the discussion here.
The question you have actually goes a little beyond this as there are actually several HTTP daemons in use on the platform and something called "multiportal" that redirects the request to the correct one.
Since this will be outside of the context of Mobile Access (or more specifically the /sslvpn prefix), you actually need to put this in the root directory for the Gaia OS WebUI, which is either in /web/htdocs or /web/htdocs2.
However, I'm pretty sure the default configuration will not allow random files placed in these directories without authentication.