The nginx conf for the .49 server[1] has a bug. The location entries are exclusive[2].

[1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-6.p... [2] http://nginx.org/en/docs/http/request_processing.html#simple...