fix security issue on handling php files by nginx