bugfix: correct subdir and customdir folder concatenation

WIP: accessible folders outside of root! huge gaping sec hole ...