added .managedusers file. please deny it in nginx settings