fixed .htaccess allow/deny locations