Not enough people are talking about this, as soon as the company took over they started to remove functionality. Shame on them.
This was not a company decision, it was proposed by a non-company member and approved by two other non-company members (and one company member, but just pointing out context).
This is horrible!
While reverse proxy auth should be disabled by default, this is critical. This breaking change makes gitea unsuitable for me going forward.
Reverse proxy auth is perfectly secure when correctly setup and is sensible in many configurations.