<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <title>Forbidden</title>
  <style>
  * { box-sizing: border-box; }
  html { width: 100%; height: 100%; }
  body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif; font-size: 18px; }
  .content { margin: 0 auto; width: 20rem;}
  pre { white-space: pre-wrap; background-color: #f8f8f8; padding: 0.5em; overflow-x: auto; }
  </style>
</head>
<body class="content">
  <h1>You are not logged in</h1>
  <p>You must be logged in to perform this action.</p>
  {% set login_url = handler.kwargs.get('login_url', None) %}
  {% import gramex %}
  {% set app_login = 'gramex.conf.app.settings.login_url' %}
  <p><a href="{{ login_url or app_login }}">Log in and try again</a>. If that fails, contact the app owner.</p>
  <pre>HTTP 401: Unauthorized</pre>
</body>
</html>
{#

Note: this template is rarely called, because:

- basehandler.py redirects to login_url if 401: UNAUTHORIZED
- authhandler.py explicitly renders specific templates if 401: UNAUTHORIZED

The rare cases where this is used are:

- If an application explicitly raises a 401
- If basehandler.py raises a 401
  - for an OTP request when user is not logged in
  - if the request is not GET/HEAD, it is not redirected to login_url

#}
