Updated php to 5.4.21.
Only allow ESI routes access for localhost.