don't use send_from_directory since it's cached