2 files changed, 8 insertions, 6 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index c0341e5..8a70887 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -53,7 +53,6 @@
 -- still lists a protected repository with its description unless cgitrc sets
 -- repo.hide=1 for it.
 
--- The values that follow are the configuration and are meant to be edited.
 
 -- Accounts live one per line as username:hash, where the hash is any kind this
 -- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on
@@ -105,6 +104,7 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+
 -- A browser accepts a cookie named __Host- only when it is Secure, covers the
 -- whole host and was set by this host, so no sibling subdomain can plant a
 -- session in its place. Either cookie setting above can rule that out.
@@ -117,8 +117,9 @@ end
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
 
--- The two lookups below, account_hash and repo_userset, are the only part
--- of this script that differs from auth-inline.lua.
+-- Apart from the configuration, the lookups below, account_hash and
+-- repo_userset with their helpers, are the only code that differs from
+-- auth-inline.lua, which defines trim later, beside get_cookie.
 
 -- Lua patterns backtrack, so "^%s*(.-)%s*$" costs the square of a run of
 -- spaces inside the text. Finding each end directly stays linear, which
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index b3ecaf9..3530890 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -53,7 +53,6 @@
 -- still lists a protected repository with its description unless cgitrc sets
 -- repo.hide=1 for it.
 
--- The values that follow are the configuration and are meant to be edited.
 
 -- Protected repositories and the users allowed into each. A repository named
 -- here is protected and one that is not named is public. The repository key
@@ -104,6 +103,7 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+
 -- A browser accepts a cookie named __Host- only when it is Secure, covers the
 -- whole host and was set by this host, so no sibling subdomain can plant a
 -- session in its place. Either cookie setting above can rule that out.
@@ -116,8 +116,9 @@ end
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
 
--- The two lookups below, account_hash and repo_userset, are the only part
--- of this script that differs from auth-file.lua.
+-- Apart from the configuration, the lookups below, account_hash and
+-- repo_userset with the fold that feeds them, are the only code that
+-- differs from auth-file.lua, which defines trim among its lookups.
 
 -- The configured tables are folded to lowercased user names once, so that a
 -- lookup matches whatever case the login form was filled in with, the way
-rw-r--r--	custom/extensions/auth-file.lua	7
-rw-r--r--	custom/extensions/auth-inline.lua	7