add empty index.php to protect non-apache sites