diff --git a/copyparty/authsrv.py b/copyparty/authsrv.py
index ead013a8..ed728eee 100644
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -355,6 +355,7 @@ class VFS(object):
         self.flags = flags  # config options
         self.root = self
         self.dev = 0  # st_dev
+        self.badcfg1 = False
         self.nodes: dict[str, VFS] = {}  # child nodes
         self.histtab: dict[str, str] = {}  # all realpath->histpath
         self.dbv: Optional[VFS] = None  # closest full/non-jump parent
@@ -1554,6 +1555,8 @@ class AuthSrv(object):
                 self.log(t, 1)
                 axs = AXS()
             vfs = VFS(self.log_func, absreal("."), "", "", axs, {})
+            if not axs.uread:
+                vfs.badcfg1 = True
         elif "" not in mount:
             # there's volumes but no root; make root inaccessible
             zsd = {"d2d": True, "tcolor": self.args.tcolor}
diff --git a/copyparty/fsutil.py b/copyparty/fsutil.py
index 5d42b43a..606cea49 100644
--- a/copyparty/fsutil.py
+++ b/copyparty/fsutil.py
@@ -131,9 +131,10 @@ class Fstab(object):
         if not self.trusted:
             # no mtab access; have to build as we go
             if "/" in rem:
-                self.tab.add("idk", os.path.join(vn.vpath, rem.split("/")[0]))
+                zs = os.path.join(vn.vpath, rem.split("/")[0])
+                self.tab.add("idk", zs, zs)
             if rem:
-                self.tab.add(nval, path)
+                self.tab.add(nval, path, path)
             else:
                 vn.realpath = nval
 
diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index fa99300b..1952014c 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -1238,14 +1238,7 @@ class HttpCli(object):
                     return self.tx_404(True)
             else:
                 vfs = self.asrv.vfs
-                if (
-                    not vfs.nodes
-                    and not vfs.axs.uread
-                    and not vfs.axs.uwrite
-                    and not vfs.axs.uget
-                    and not vfs.axs.uhtml
-                    and not vfs.axs.uadmin
-                ):
+                if vfs.badcfg1:
                     t = "<h2>access denied due to failsafe; check server log</h2>"
                     html = self.j2s("splash", this=self, msg=t)
                     self.reply(html.encode("utf-8", "replace"), 500)