I just read on the Wiki why you missed out putting head in the limit_except block. "Allowing the GET method makes the HEAD method also allowed." Posted at Nginx Forum: http://forum.nginx.org/read.php?2,254125,254167#msg-254167