added note about serving files outside of webroot