add deny from all .htaccess to app folders