bugfix: web/username_prefix.php: need to handle : in login (which would normally indicate a password)

web/.htaccess: auto-detect dotpath: need to explicitly set usernames_disabled=1, because for some reason the `%{QUERY_STRING} =""` check doesn't detect a query string

web/.htaccess: auto-detect dotpath: removed handling of no longer used @ prefix (used to be used by username-based prefix subpaths)

bugfix: web/.htaccess: username-based prefix subpaths: usernames_disabled: also need to support it being set in the current round

bugfix: web/.htaccess: username-based prefix subpaths: removed support for query strings because these are often used at the root level, and should then be treated as a regular dotpath rather than something with a username-based prefix

bugfix: web/.htaccess: forced mod_autoindex listing: use $usernames_disabled to ensure that usernames stay disabled even when /all path is removed

bugfix: web/.htaccess: username-based prefix subpaths: added back usernames_disabled env var, because it is needed if a RewriteRule in a previous round creates an empty path (mod_rewrite runs the RewriteRules repeatedly until no replacements are made)

bugfix: web/.htaccess: username-based prefix subpaths: REDIRECT_REQUEST_URI: also allow it to be unset, as it is when using usernames

fix: web/index.php: directory index: don't append QUERY_STRING, as this is not used by /all

web/.htaccess: username-based prefix subpaths: removed usernames_disabled env var because the bug that appeared to require this has now been fixed