According to the change log for 0.9 , VLC (at least the Linux port) "now complies with the XDG Base Directory Standard". However, this is not the case of at least the HTTP interface. I wrote the information on access control on the wiki, and if the XDG standard had been followed, that info...