Don't allow files in hidden directories to be served (backported)

Backported 1.1.x version of #12.

/cc @geek