add dotfiles support

#492 with whitelist support
I don’t think we should default to `.{htaccess,htpasswd}` here. I believe the default should be empty.

Having an empty default is both more predictable and more explicit.