split file serving into 'serveFile' and 'servePublicFile'

This change is to allow serving files,
from outside of the public directory.

By default, request based files are still restricted.
However when serving manually, you can do so
from anywhere.