change .htaccess settings to protect ajax