Small security fixes

Application folder needs htaccess to disallow any public access
And all files inside app folder need a defined BASEPATH check just for more security