put all client side code into public folder so no one can access backend stuff