Nginx sub-request authorization