path correction

public/.htaccess

@@ -0,0 +1,15 @@
+# Deployed under /citpl_website/ on Apache.
+# Requires: mod_rewrite, mod_headers, and (for API) mod_proxy + mod_proxy_http
+
+RewriteEngine On
+
+# Proxy Node API + uploads (start server with: node server/index.js)
+RewriteRule ^api/(.*)$ http://127.0.0.1:3001/api/$1 [P,L]
+RewriteRule ^uploads/(.*)$ http://127.0.0.1:3001/uploads/$1 [P,L]
+
+# Allow admin login/section preview to iframe this page (same origin)
+<Files "preview.html">
+  Header always unset X-Frame-Options
+  Header always unset Content-Security-Policy
+  Header always set Content-Security-Policy "frame-ancestors 'self'"
+</Files>