# Many shared-hosting/cPanel setups strip the Authorization header before
# it reaches PHP (a FastCGI limitation), which would break the login-token
# check in index.php even with a correct token. This forwards it through.
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

<IfModule mod_authz_core.c>
    CGIPassAuth On
</IfModule>
