Moved _init and "protected" thankyou page

Moved _init.php from /controllers/ to /core/.
Made a little adjustment  in the layout and "protected" the thankyou
page to be accessible only after an order completion.