more secure nginx setup
no need for /doc path