1 file changed, 4 insertions, 3 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index c0341e5..8a70887 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -53,7 +53,6 @@
 -- still lists a protected repository with its description unless cgitrc sets
 -- repo.hide=1 for it.
 
--- The values that follow are the configuration and are meant to be edited.
 
 -- Accounts live one per line as username:hash, where the hash is any kind this
 -- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on
@@ -105,6 +104,7 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+
 -- A browser accepts a cookie named __Host- only when it is Secure, covers the
 -- whole host and was set by this host, so no sibling subdomain can plant a
 -- session in its place. Either cookie setting above can rule that out.
@@ -117,8 +117,9 @@ end
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
 
--- The two lookups below, account_hash and repo_userset, are the only part
--- of this script that differs from auth-inline.lua.
+-- Apart from the configuration, the lookups below, account_hash and
+-- repo_userset with their helpers, are the only code that differs from
+-- auth-inline.lua, which defines trim later, beside get_cookie.
 
 -- Lua patterns backtrack, so "^%s*(.-)%s*$" costs the square of a run of
 -- spaces inside the text. Finding each end directly stays linear, which