deny http access to _public
Updated instructions