deny web access to _OS_SETTINGS

I don't really see a reason why this should be accessible via web...
Merge pull request #31 from jomo/patch-1

deny web access to _OS_SETTINGS