Add .htaccess to protect subdirectories