RewriteEngine On

# Apache + mod_php doesn't pass the Authorization header through to PHP by
# default (historically stripped to avoid leaking credentials to CGI
# scripts) — this re-exposes it as $_SERVER['HTTP_AUTHORIZATION'], which
# Auth::currentDevice() reads.
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

RewriteRule ^(.*)$ public/index.php [L]
