Added sites/default/files/.htaccess per https://drupal.org/SA-CORE-2013-003.