Don't allow requesting anything in /vendor/ and /app/ except /app/view/ and /app/classes/
Fixes #375
Merge pull request #380 from richardhinkamp/no-access-vendor-app

Don't allow requesting anything in /vendor/ and /app/ except /app/view/ and /app/classes/