Lighttpd

I had a working configuration in 1.4.54 based on the regular expression example in the ModAuth wiki doc. After upgrading to a 1.4.56, I noticed a change in behavior: now access to a restricted URL is allowed without authentication. Here is the previously working config:

$HTTP["url"] =~ "^/api/v1/s" {
    # block 2
        auth.require = (
            "" => (
                "method"  => "basic",
                "realm"   => "Restricted",
                "require" => "valid-user",
            # 3
            ),
        )

} # end of $HTTP["url"] =~ "^/api/v1/s"

Removing the outer regex wrapper from the inner auth.require stanza gets me this config, which works in the sense of requiring authorization, but restricts everything, not just my restricted area:

auth.require                   = (
        "" => (
            "method"  => "basic",
            "realm"   => "Restricted",
            "require" => "valid-user",
        # 3
        ),
    )

I'm using curl to test:

$ curl http://<fqdn>:<port>/api/v1/status

As far as I can tell, this is something that changed in 1.4.56. I'm also using mod_auth, mod_authn_ldap, and uwsgi via mod_scgi if that makes a difference.