changed the check against direct access to php files