prevent path disclosure in some files

Fix files that don't have the usual check to avoid direct access.
They're protected by .htaccess but anyway better to have this.