forbid serving hidden files from `/files`
test /files/ gives 403 on hidden files
update test requirements for IPython.html