moved docroot check to 403 forbidden.