htacess now properly restricts any php file