provisioning bug fixes

it appears nginx must be able to execute (list contents) of all parent directories of the served directory. So we give the x permission on the two parent directories. This is brittle - if there are more than that, then there is a problem. But it should work for now.