Don't allow requesting anything in /vendor/ and /app/ except /app/view/ and /app/classes/

Fixes #375