add safety check in createLayout.php
deny access to layout and template folders
items/list: move grouping to template