only in patch2:
unchanged:
--- a/.htaccess
+++ b/.htaccess
@@ -138,6 +138,8 @@ AddEncoding gzip svgz
   # security, you can replace '!/' with '!^/'.
   # Allow access to PHP files in /core (like authorize.php or install.php):
   RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
+  # @todo Remove this once the <none> bug is fixed.
+  RewriteCond %{REQUEST_URI} !/core/authorize.php/<none>$
   # Allow access to test-specific PHP files:
   RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?.php
   # Allow access to Statistics module's custom front controller.