The `/files` handler already prevents access to hidden files. This was a rather quick and dirty fix so that if you start the server in your home directory, you're not serving your SSH keys.