make sure lib/ is allowed anonymously