task 2: do not serve files outside current directory