setup tutorial; moved web root up one folder for security to hide sys/ and app/