ensure htaccess files are used

The htaccess files contain a few rewrites that ensure basic hiding of
scripts that shouldn't be accessed is enforded. This commit is based on
the changes in pull request #298 (thanks goes to @minad).

Also in this commit is a re-ordering of Dockerfile statements to
leverage caching when working on the apache configuration. There are
probably other improvements to be made but I'm not enough of a PHP
expert to spot them.