prevent direct access to application directory (not possible anyway)
robots.txt not required