bugfix: web/index.php: directory index: use QUERY_STRING, not HTTP_AUTHORIZATION (HTTP_AUTHORIZATION was probably left over from a previous attempt to provide username-based prefix subpaths)