updated settings.php
added fixed rules for paths to lock down security