app.py

@@ -274,7 +274,6 @@ $("#padname").textContent = "/"+docId+"/";
 
 let ws, ver = 0, clientId = Math.random().toString(36).slice(2), debounce;
 let isProtected = false, isAuthed = false;
-const urlPw = new URLSearchParams(location.search).get("pw") || "";
 
 // --- Line numbers ---
 const ta = $("#t");
@@ -383,11 +382,7 @@ function connect(){
       updateLockBtn();
       if (msg.peers !== undefined) { const el = $("#peers"); el.textContent = msg.peers; el.style.display = "inline"; }
       if (isProtected && !isAuthed) {
-        if (urlPw) {
-          ws.send(JSON.stringify({type: "auth", password: urlPw}));
-        } else {
-          showOverlay();
-        }
+        showOverlay();
       } else {
         isAuthed = true;
         hideOverlay();
@@ -399,7 +394,6 @@ function connect(){
       // Real init with content follows immediately from server
     } else if (msg.type === "error") {
       if (!isAuthed) {
-        showOverlay();
         const errEl = $("#auth-error");
         errEl.textContent = msg.message;
         errEl.style.display = "block";