added .htaccess (deny from all) for Phundament/ and app/