Security hole - don't expose that a directory exists
Default content type based on mime type