Allow URIs specified in file directives implicitly It seems to me that, by specifying that one wants to serve a given file at a specified URI, one is implying that this URI should be allowed.

fun main () : transaction page =
    let
        return <xml>Hi {[alice]} and {[bob]}!</xml>
    where
        val alice = "Alice"
        val bob = "Bob"
    end