Add .htaccess to deny access to config dir