whitespace cleanup
simpleauth should work without HTTP_REFERER