I added a subdirectory under root and made it browsable. There are no restrictions per user in either root or this dir. If the root dir / is not made browsable itself, then I can't see any of the styling (css) and neither of the javascript functions work. HFS issues a "403 forbidden":
GET /?mode=section&id=lib.js HTTP/1.1
GET /?mode=section&id=style.css HTTP/1.1
HTTP/1.1 403 Forbidden
Content-Type: text/html
Accept-Ranges: bytes
Server: HFS 2.3 beta
Content-Encoding: gzip
This is on beta #283