You can set the server's static folder to whatever you like. You can also use a filter to block certain requests and restrict access.
Dim srvr as Server
srvr.Initialize("srvr")
srvr.StaticFilesFolder = File.Combine(File.DirApp, "statics")
will set the server's static folder (this is the folder with the static pages and and static directories that the server can serve up to clients). You can leave the folder empty if you want.
srvr.AddFilter("/*", "SecurityFilter", False)
will send every request through a filter. Make sure to construct a Filter Class called "SecurityFilter" and do your filtering in the Filter() sub of that class.
Here's a tutorial on filters:
https://www.b4x.com/android/forum/threads/server-login-system-filters-tutorial.39020/#content