restrict direct access to run.php