htacess to block users from calling core files directly