rm deprecate. add private dir for server files outside
htdocs/files