Preventing access to files outside www