make htaccess deny in src and app work with apache 2.4

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | |no
| Tests pass?   | yes
| Fixed tickets | #602
| License       | MIT

Based on findings in https://drupal.org/node/1599774
Made it work under both apache 2.2 and 2.4.