restrict access to public files only

use mod_rewrite to pretend theese files are not existend for security purposes

this would make the brances be used in production environment #12423
would suggest to merge this into stable7

allowed ocs compared to #12474