serve 403 for keyfile/certfile access via symlink