Added a few comments, and .htaccess to prevent access to config.json