# Block direct browsing of config and library files.
<FilesMatch "^(config|lib|ghl)\.php$">
    Require all denied
</FilesMatch>
# Pass the Authorization header through to PHP on CGI/FastCGI hosts.
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# The account's docroot-level .htaccess sets a blanket
# Access-Control-Allow-Origin: * for every domain on this server. lib.php's
# cors() sets its own origin-specific header per request (needed to send
# credentials/Authorization at all — "*" can't be paired with that), and
# Apache was sending BOTH, which browsers reject outright ("contains
# multiple values"). Unset the inherited ones here so only PHP's own apply.
<IfModule mod_headers.c>
    Header unset Access-Control-Allow-Origin
    Header unset Access-Control-Allow-Methods
    Header unset Access-Control-Allow-Headers
</IfModule>
