Leave media_folder var at generic default (whoops); catch and avoid another crash when trying to list a subdirectory without read perms
Give subdir read error a more accurate status code (403 vs 404)