Added .htaccess to sites/default/files per https://drupal.org/SA-CORE-2013-003.