# Forces the Authorization header through to PHP — many Apache/mod_php
# setups (including this local wamp64 install, and most shared hosting)
# strip it before PHP ever sees $_SERVER['HTTP_AUTHORIZATION'] otherwise.
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

# Never serve raw source/config files directly.
<FilesMatch "\.(sql|md)$">
    Require all denied
</FilesMatch>
