add .htaccess with deny all to private folders