Disallow access to app_dev.php unless SFDEV is set in vhost