moved htm outside public, always served by express