Secure pw directory with deny all htaccess