server: more restrictive folder permissions