security hardening: we don't want the anonymous user to look at our fs