Don't serve PHP files from uploads directory.