Am I going crazy? Mixing auth and PHP...

[mike]

http://foo.com/reports/ - prompts for auth like it should
http://foo.com/reports/report.php - bypasses http auth

the .php is being matched and the other location is ignored completely?

        server {
                listen 80;
                server_name foo.com;
                index index.php index.html;
                root /home/foo/web/foo.com/;
                location /reports {
                    auth_basic "Reports";
                    auth_basic_user_file /home/foo/web/foo.com/.htpasswd;
                }
                location ~ \.php {
                        fastcgi_pass 127.0.0.1:11019;
                        fastcgi_index index.php;
                }
        }

Anything wrong here?

How can I get auth working for the whole /reports dir? I tried even
putting in the exact /reports/report.php URL in a location block, a
regexp ^/reports etc...