Summary: Apache 2.4\'s mod_proxy does not seem to be passing the Authorization headers to PHP-FPM. Is there any way to fix this?
Long vers
This took me a long time to crack, since it's not documented under mod_proxy or mod_proxy_fcgi.
Add the following directive to your apache conf or .htaccess:
CGIPassAuth on
See here for details.