private files will 404