--- a/src/luan/host/WebHandler.java	Tue Sep 24 17:17:57 2024 -0600
+++ b/src/luan/host/WebHandler.java	Thu Sep 26 15:07:45 2024 -0600
@@ -7,6 +7,8 @@
 import java.lang.ref.WeakReference;
 import java.lang.reflect.Method;
 import java.util.Set;
+import java.util.Map;
+import java.util.LinkedHashMap;
 import java.util.Collections;
 import java.util.concurrent.ConcurrentHashMap;
 import goodjava.logging.Logger;
@@ -66,7 +68,37 @@
 		}
 	}
 
+	private static final class AuthInfo {
+		String realm;
+		String username;
+		String password;
+		Handler auth;
+	}
+	public static final class AuthDomain {
+		final Map<String,AuthInfo> authMap = new LinkedHashMap<String,AuthInfo>();
+
+		public void authorize(String path_ptn,String realm,String username,String password) {
+			AuthInfo info = new AuthInfo();
+			info.realm = realm;
+			info.username = username;
+			info.password = password;
+			authMap.put(path_ptn,info);
+		}
+	}
+
+	private static final Method dontGcMethod;
+	private static final Method authorize;
+	static {
+		try {
+			dontGcMethod = WebHandler.Fns.class.getMethod( "dont_gc" );
+			authorize = WebHandler.AuthDomain.class.getMethod( "authorize", String.class, String.class, String.class, String.class );
+		} catch(NoSuchMethodException e) {
+			throw new RuntimeException(e);
+		}
+	}
+
 	private static final DomainHandler.Factory factory = new DomainHandler.Factory() {
+
 		public Handler newHandler(String domain) {
 			File dir = new File(sitesDir,domain);
 			if( !dir.exists() )
@@ -80,27 +112,22 @@
 				throw new RuntimeException(e);
 			}
 
+			AuthDomain authDomain = new AuthDomain();
+			Fns fns = new Fns();
 			Luan luan = new Luan();
-			String password;
 			LuanLogger.startThreadLogging(luan);
 			try {
+				LuanTable Hosted = (LuanTable)luan.require("luan:host/Hosted.luan");
+				Hosted.put( luan, "authorize", new LuanJavaFunction(authorize,authDomain) );
 				LuanFunction fn = Luan.loadClasspath(luan,"luan/host/init.luan");
 				fn.call(luan,dirStr,domain);
-				LuanTable Io = (LuanTable)luan.require("luan:Io.luan");
-				password = (String)Io.get(luan,"password");
-				if( password==null )  throw new NullPointerException();
+				LuanTable Http = (LuanTable)luan.require("luan:http/Http.luan");
+				Http.put( luan, "dont_gc", new LuanJavaFunction(dontGcMethod,fns) );
 			} catch(LuanException e) {
 				throw new LuanRuntimeException(e);
 			} finally {
 				LuanLogger.endThreadLogging();
 			}
-			Fns fns = new Fns();
-			try {
-				LuanTable Http = (LuanTable)luan.require("luan:http/Http.luan");
-				Http.put( luan, "dont_gc", new LuanJavaFunction(dontGcMethod,fns) );
-			} catch(LuanException e) {
-				throw new RuntimeException(e);
-			}
 			security(luan,dirStr);
 			LuanHandler luanHandler = new LuanHandler(luan,domain);
 
@@ -112,8 +139,14 @@
 			Handler notFoundHander = new NotFound(luanHandler);
 			notFoundHander = new ContentTypeHandler(notFoundHander);
 			handler = new ListHandler( handler, dirHandler, notFoundHander );
-			Handler auth = new BasicAuthHandler(handler,"Private","admin",password);
-			handler = new RegexHandler("^/private/",auth,handler);
+			for( AuthInfo info : authDomain.authMap.values() ) {
+				info.auth = new BasicAuthHandler(handler,info.realm,info.username,info.password);
+			}
+			for( Map.Entry<String,AuthInfo> entry : authDomain.authMap.entrySet() ) {
+				String path_ptn = entry.getKey();
+				AuthInfo info = entry.getValue();
+				handler = new RegexHandler(path_ptn,info.auth,handler);
+			}
 			handler = new HeadersHandler(handler);
 			handler = new SafeHandler(handler);
 			handler = new LogHandler(handler,LogHandler.dirLogger(new File(logDir),days30));
@@ -212,14 +245,6 @@
 
 
 	private static final Set<MyHandler> dontGc = Collections.newSetFromMap(new ConcurrentHashMap<MyHandler,Boolean>());
-	private static final Method dontGcMethod;
-	static {
-		try {
-			dontGcMethod = WebHandler.Fns.class.getMethod( "dont_gc" );
-		} catch(NoSuchMethodException e) {
-			throw new RuntimeException(e);
-		}
-	}
 	public static final class Fns {
 		private Reference<MyHandler> ref = null;
 		private boolean dont = false;

--- a/src/luan/host/init.luan	Tue Sep 24 17:17:57 2024 -0600
+++ b/src/luan/host/init.luan	Thu Sep 26 15:07:45 2024 -0600
@@ -63,6 +63,7 @@
 
 Http.set_domain(domain)
 Hosted.is_hosted = true
+Hosted.authorize( "^/private/", "Private", "admin", Io.password )
 
 
 -- postgres