http auth on all except /share-download

[johnbeller]

As an additional security measure I would like to password-protect /, /share-create and /share-edit - but not /share-download.
I tried (for a few hours, also 'helped' by useless chat and gemini) in Caddy and in NGINX but could not find how. Having an example on the site would be great!

I kind of had it working but all /random would go to /share-create without requiring a password.

Another one: if I use an upload password (in the application), this password is remembered by my browser (great) - but then automatically also used this (so the same) password to protect the download link under the Advanced Options unless I remove it. Minor.

And when I'm at it, being able to remove the TOS link would also be nice. Also minor.