define InlineBackend configurable in its own file

avoids unnecessary matplotlib imports
use get_ipython API function, not builtin injection, to detect IPython.
forbid serving hidden files from `/files`