# Only the two public endpoints can be called from a browser.
<FilesMatch "\.php$">
  Require all denied
</FilesMatch>
<FilesMatch "^(challenge|register)\.php$">
  Require all granted
</FilesMatch>
