bump nginx to latest 1.2 series (1.2.9)

Bumping to 1.2.9 fixes CVE-2013-2070, but this is now the 'legacy' release series.

I'm looking into jumping up to 1.4 (new stable series) shortly if that's not expected to break anything.