add direct file access deny