fix __password__/__hostsdeny__ for index.js