Allow URIs specified in file directives implicitly It seems to me that, by specifying that one wants to serve a given file at a specified URI, one is implying that this URI should be allowed.

table user : {A : int}

fun main () =
    r <- oneRow (SELECT COUNT( * ) AS N FROM user);
    return <xml>{[r.N]}</xml>