authentication/authorization made in up-level, before nginx will try to map location to file-system path. So check your config. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,3376,3397#msg-3397