changed security to allow nested  directory javascript to permit all