Preventing access to app directory with htaccess