The request processor will return mounted files if it finds them, then look under the page root if it doesn't. So if you create /web/servername/www/foo/admin, the request processor ignores that and serves the (automatically) mounted admin directory for the subsite.
It's the other way round. This alows you to override pages in a package for a particular instance.
It sounds like Roger needs to create a folder with the site map under his subsite. If the subsite is mounted at /casa, then create a folder (but do not mount anything on it) /casa/static. He can then use the 'permissions' link to restrict access /casa/static to whoever...
As alex says, this static content would be placed at /web/servername/www/casa/static in the filesystem.
