- read/write permissions handled correctly
- scopes permissions handled correctly
- public special handling
    - read access without bearer token (but no directory listing!)
    - read/write/delete access with bearer token
- think about security (breaking out the storage dir)