security fix to static file serving, added api, added catalog