adding htaccess to stop access in app directory