only explicit folders served from private; add index key to handleEdit