public files static, private ones via db