not handing the fla over is locking the clietn out of his own web site.

imo thats not professionally. .fla should be handed over, adn clearly stated so in contract.