SECURITY: Block direct access to files

User QR-Codes and [username].db cannot be accessed anymore from a direct URL call.