Add .htaccess, protect config.json