TODO

  - make sure permission to see private folder is OK