Fixed a security flaw:

.inc files can be read from the web including `config.inc' which contains
the account information (login, password) to the MySQL database.  Apache
has now been setup to deny access to all *.inc files from the web.

.htaccess

@@ -3,9 +3,17 @@
 #
 
 # Archive feature:
-#<Files archive>
-#  ForceType application/x-httpd-php
-#</Files>
+<Files archive>
+  ForceType application/x-httpd-php
+</Files>
+
+# Protect .inc files:
+#  .inc files can be read from the web so make sure we keep it 
+#  away from the casual prying eyes.  Especially `config.inc'.
+<Files *.inc>
+  order deny, allow
+  deny from all
+</Files>
 
 # Customized server error messages:
 ErrorDocument 400 /error.php