no server side access control for now.. but the file is there