Update docs - security best practices, .htaccess