fixes #82 protect some sensitive directories from web access