deny access to theme dir