HMVC, security, serve file