dissallow direct access to php files in assets dir