Deny requests to /includes directory