Oh stupid me. This is just great. While working too tired, one makes mistakes. I somehow did not realise that I had watched wrong part of the code. On zpt_generic index_html there is no authorization checking for listing folders. But it is easy to add following the example. I'll go to sleep and kick myself.. Stupid stupid. -huima