make htaccess deny in src and app work with apache 2.4