restrict access to public files only

use mod_rewrite to pretend theese files are not existend for security purposes

this would make the brances be used in production environment #12423
would suggest to merge this into stable7

allowed ocs compared to #12474
So i'll create a third PR, if there's nothing more to complain about...?