secure file access api (limited to user folder and world folder)