WIP: nearly done switching to using header instead of url parameters

docs/env.example

@@ -0,0 +1,59 @@
+# --- Main Options ---
+
+# URI containing secret and config for TOTP, which determines the token to login
+# app will generate one, if not provided, but you should copy it to your .env file
+# format: "otpauth://totp/<label>?secret=<secret-key>"
+#TOTP_URI=''                # blank to have the app generate one at random
+
+# how long will someone stay logged in, measured in seconds, zero for DEFAULT
+#COOKIE_TTL=2592000         # default 30 days
+
+# NOTE: rate limiting can *NOT* be disabled,
+# but you could allow hundreds of logins a second
+
+# number of consecutive failed login attempts before we block the ip address
+#LIMIT=4                    # default 4 failed login attempts before blocking
+
+# time between failed login attempts that are consecutive, in seconds, zero for DEFAULT
+#LIMIT_TIMEOUT=21600        # default 6 hours
+
+# how long a blocked ip address stay blocks, in seconds, zero for DEFAULT
+#LIMIT_TTL=86400            # default 24 hours
+
+# --- Extra Options ---
+
+# query parameter prefix to prevent collisions with protected app
+#QUERY_PREFIX='_preauth_'
+
+# TODO make it so boolean options can be true/false
+
+# allow files in /app/public/assets directory to be served, false to disable
+#ASSETS=true                # default enabled, boolean
+
+# how long do we allow *ALL* traffic from an ip address after successful login
+# could be useful if you have a system which does not handle cookies
+#IP_TTL=0                   # default disabled, time in seconds
+
+# if desired, in addition to supporting a TOTP, you can set a static password
+#STATIC_SECRET=''           # deafult disabled
+
+# once blocked, do we respond with "I'm a teapot", false to use "Too many requests"
+#TEAPOT=true                # default enabled, boolean
+
+# --- Styling Options ---
+#TITLE='Pre-Authentication System'
+#ICONS=false                # default disabled, boolean, use favicon from root domain
+#BG_COLOR='#029386'         # teal
+#FG_COLOR='#ffffff'         # white
+#ERROR_COLOR='#ffb16d'      # apricot (light orange)
+#ID_NAME='Session ID'
+#TOKEN_NAME='Authentication Token'
+#SUBMIT_NAME='Submit'
+#ERROR_MESSAGE='Unsuccessful login attempt'
+# title and message to use on block page, if teapot is true
+#TEAPOT_TITLE="I'm a teapot"
+#TEAPOT_MESSAGE='I refuse to brew coffee'
+# title and message to use on block page, if teapot is false
+#TOO_MANY_TITLE='Too many requests'
+#TOO_MANY_MESSAGE='Try again later'
+