# Only api.php is web-accessible
<FilesMatch "^(config|config\.sample)\.php$">
    Require all denied
</FilesMatch>
<FilesMatch "\.(md|json|log)$">
    Require all denied
</FilesMatch>
# Pass the Authorization header through to PHP (needed on some Apache/CGI setups)
RewriteEngine On
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
