Prevent arbitrary file requests + rework web file handler