added location directive to allow access if deny is (hopefully) default