`CHANGES2.md`

11 lines
## Round 2 Applied
- `views/admin.ejs:414` — removed the hardcoded `Authorization: Basic admin:admin123` header from the page-load API fetch and set same-origin credentials — fixes CODEX_REREVIEW missed call-site / P1 broken admin UI auth.
- `views/admin.ejs:475` — removed the hardcoded `Authorization: Basic admin:admin123` header from image uploads and set same-origin credentials — fixes CODEX_REREVIEW missed call-site / P1 broken admin UI auth.
- `views/admin.ejs:497` — removed the hardcoded `Authorization: Basic admin:admin123` header from page saves, kept JSON content type, and set same-origin credentials — fixes CODEX_REREVIEW missed call-site / P1 broken admin UI auth.

## Still Deferred
- `ecosystem.config.js:11` — PM2 production env still lacks `SITE_USERNAME`, `SITE_PASSWORD`, `SESSION_SECRET`, and `ADMIN_PASSWORD`; PM2 ecosystem files are explicitly out of scope for this pass, so Steve needs to wire these in the deployed secret/process config.
- `src/server.ts:52` / `src/server.ts:62` / `src/server.ts:69` — fail-fast env checks remain a deploy concern until the production environment is updated with the required variables.
- `views/admin-login.ejs:179` — stale default credential text remains from earlier findings, but login/session flow work was previously deferred as broader auth behavior.
- `src/migrations/002_create_cms_tables.sql:50` — old `admin123` migration comment remains in a protected migrations path and was not touched.