fix nginx proxy_pass sockets

That would probably make sense; app's `ubuntu`, nginx is `www-data`. Can we try to have the socket `chown`'d to `ubuntu:www-data`, and then run it with perms `770`? That'd mean app and webserver can write, but not other users on the system