add configuration to deny serving of all files except php and static files