restrict direct requests to /expdata/* URLs (so private experiment data is not exposed)