File: /usr/local/www/wsgi-scripts/msauth.wsgi (repo: ~/py/popit3/msauth.wsgi). A thin proxy that loads the real script from /home/dav/wsgi/wsgi_get_pop_refresh_token.py and delegates all WSGI calls to it.
The real script lives in /home/dav/wsgi/ which is under the WebDAV vhost DocumentRoot. Scripts in /usr/local/www/wsgi-scripts/ already have Require all granted and work without extra config.
Note: if the script is ever moved to /usr/local/www/wsgi-scripts/ directly, the shim becomes unnecessary.
On every request the shim checks the mtime of the source file. If it has changed since last load, it reloads the module. Uses double-checked locking (threading.Lock) for thread safety under multi-threaded Apache.
/home/john/.local/lib/python3.13/site-packages is inserted at the front of sys.path so that msal and other user-installed packages are found when running as www-data.