Added ability to blacklist VCS paths by regex, also throwing up a 403 if so, to the client.