git: Don't ignore 'var'
demo: Protect secrets with htaccess