Update htaccess to restrict access to config.json