more secure .htaccess order