1. Installation type change for cf PaaS providers with configurable htdocs directory.
2. Throw 403 when resource/model forbidden.
merge