Updated .htaccess

* Blocks browser access to .php files, so one can't hit Controller or Model PHPs directly
* Added rule for .phtml suffix (Views)