Options -Indexes
<FilesMatch "^(config\.php|config\.sample\.php|README\.md|credential\.txt)$">
  Require all denied
</FilesMatch>
# pass the Authorization header through to PHP (api.php Bearer token)
SetEnvIf Authorization "(.+)" HTTP_AUTHORIZATION=$1
