Looking more carefully, the new nsd can follow symlinks outside the
doc root tree, but it now obeys the user and group permissions set
by the -u and -g flags.
Rob didn't recall anything particular, just suggested that
maybe the old aolserver version had some bug in setting it's
group, so it could access some directories it ought not to be able to
when running as -u nsadmin -g web or whatever.
I guess the new behavior is more correct, since previously, the server could access my personal directory via symlink, which it
should not have been able to do...
