Is there a way I can setup the server access perhaps with a htaccess file that would stop people getting at the folders.

It seems for ImageHandler to work the folder permissions have to be 777