Fix a security risk
make it impossible to get a file not in the data folder over the data
handler