deny rules for prefork,threaded libraries