# Make sure Apache forwards the Authorization header to PHP
# (needed on some suPHP / FastCGI / CGI setups). Done via RewriteRule rather
# than CGIPassAuth for compatibility with older Apache (CGIPassAuth needs 2.4.13+).
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

# Internal storage, config, and tooling are never served directly.
RewriteRule ^_store(/|$) - [F,L]
RewriteRule ^_config(/|$) - [F,L]
RewriteRule ^_tools(/|$) - [F,L]

# Let the gate script itself be requested directly (it will 404 without a path).
RewriteRule ^gate\.php$ - [L]

# Everything else under /secure/ goes through the token gate.
RewriteRule ^(.*)$ gate.php [L,QSA]
