Sleipnir v1.0.3

Since v0.1.6, Sleipnir reached its 1.0 milestone and picked up a batch of Apache-compatibility work. Here's what changed:

v1.0.0 — HTTP Basic Auth (.htpasswd)

• Native support for .htaccess Basic Auth — AuthType Basic, AuthName, AuthUserFile, and Require valid-user / Require user <list>.
• Supports every password format htpasswd produces: APR1 (the default), bcrypt (-B), crypt ($1$/$5$/$6$, DES), and {SHA} (-s).
• Returns a proper 401 with a WWW-Authenticate challenge so browsers prompt for credentials; the deepest matching .htaccess wins.
• Works exactly like Apache/LiteSpeed — drop in your existing .htaccess and .htpasswd, no server config needed.

v1.0.1 — mod_rewrite compatibility

• %{VAR} server variables now expand inside RewriteRule substitutions (e.g. redirecting to ...%{REQUEST_URI}).
• Added %1–%9 backreferences to the last matched RewriteCond (the classic strip-www idiom now works).
• Query strings are now preserved across redirects, matching Apache — no more dropped ?utm_... / deep-link params.
• %{REQUEST_URI} in rewrites is now path-only (query excluded), matching Apache's mod_rewrite.

v1.0.2 — Custom error pages for 401

• error_page 401 now applies to Basic Auth responses, so protected areas can show a branded 401 page — with the WWW-Authenticate challenge still attached.

v1.0.3 — Redirect hang fix

• Fixed redirects to long target URLs hanging on GET requests (a Content-Length/body-length mismatch). Redirects are now correct for any URL length.