[server] add access control rules and static file serving