I have my Mage2 site set up on an EC2 and use ssl access, plus a custom admin url and the permissions are all correct. However, I want to add .htaccess to my admin. What file do I need to add this too? The root .htaccess? And can I use order deny,allow or is there a better way? What other things should I be focused on (I have added captcha to admin and forced password change) to increase security?