added .htaccess to keep baddies away from api key