Thanks for the response.

For this -

location /index.php {
error_page 401 403 /not_authorized.html;
auth_request /auth.php;
proxy_pass http://hiphop:4247;
}

Does it mean that auth.php should be available via the url - http://hiphop:4247/auth.php ?

location = /auth.php {
# FCGI stuff or whatever PHP CGI you're using.

# auth.php should return 401 or 403 when auth process fails, return
# 200 otherwise
}

Does it enter this section after it gets 2xx response from auth.php?