Options -Indexes

# Shared hosts often drop the Authorization header before PHP sees it.
# Pass it through so the logged-in user's token reaches the API.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP:Authorization} .
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

# Never serve .env or other dot-files.
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
