protect setting.php, even though php will not output our settings on direct access