Add .htaccess that hides private files.