deny web access to _OS_SETTINGS

I don't really see a reason why this should be accessible via web...