htaccess: deny access to anyone surfing for wp-config.php