block direct access to config.php with .htaccess