Don't allow files in hidden directories to be served

Backported #12. Replaces #13.