Avoid directory traversals
Use secrets.yml and allow set x_sendfile_header
Merge pull request #1 from android-frontier/improvements

improvements