avoid to allow reading files which are not under the webserver directory