Serve standalone game without login

Dockerfile

@@ -17,7 +17,7 @@ RUN touch src/main.rs && cargo build --release --target wasm32-unknown-unknown \
  && cp target/wasm32-unknown-unknown/release/dungeoncraft.wasm /out/ \
  && cp "$CARGO_HOME"/registry/src/*/macroquad-*/js/mq_js_bundle.js /out/
 
-# --- standalone: the whole game in one HTML file (downloadable for logged-in users)
+# --- standalone: the whole game in one HTML file (downloadable without login)
 FROM python:3-alpine AS standalone
 WORKDIR /w
 COPY www/ www/

INSTALL.md

@@ -99,7 +99,7 @@ The game also autosaves into the browser every two minutes and when the tab is c
 
 ### Savegame service
 
-A small Rust service (axum) in `server/` keeps the user accounts (Argon2 password hashes) and the savegames as files in the Docker volume `savegames` (one folder per user). nginx forwards `/api/` to it; the service itself is not published. The standalone file is served under `/standalone/` only for logged-in users (nginx `auth_request`).
+A small Rust service (axum) in `server/` keeps the user accounts (Argon2 password hashes) and the savegames as files in the Docker volume `savegames` (one folder per user). nginx forwards `/api/` to it; the service itself is not published. The standalone file is served under `/standalone/` as a public file, so it can be downloaded before login.
 
 | Request | Meaning |
 |---|---|

nginx.conf

@@ -12,9 +12,8 @@ server {
         default_type application/manifest+json;
         try_files $uri =404;
     }
-    # the standalone file only for logged-in users (checked by the service)
+    # the standalone file is public: it can be downloaded before login
     location /standalone/ {
-        auth_request /api/auth;
         try_files $uri =404;
     }
     # savegame service (server/). Resolved at request time, so the game still starts without it;