move public stuff to web dir for better security separation