api: setting proper permissions on public folder