deny from all in /includes

No reason anyone should need to use these, can skew statistics and cause errors.  Just best to hide it from the public.