Add .htaccess "deny from all" file to app/