fix: crash requesting a folder inside static folder
serving.serve()
fix: security limit
minor changes
backend: some optimizations