I haven't been able to figure out why, but something that I noticed whilst testing D12299 is that HTTP status codes aren't surfacted properly:
> curl -I https://secure.phabricator.com/foo HTTP/1.1 200 OK Server: nginx Date: Mon, 06 Apr 2015 21:31:35 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.4.16 Set-Cookie: phsid=A%2F6okkvmvadl5vj5w3uzx3xkndlpaornibeqxn7o4a; expires=Sat, 04-Apr-2020 21:31:34 GMT; path=/; domain=secure.phabricator.com; secure; httponly Set-Cookie: next_uri=1428355894%2C%2Ffoo; path=/; domain=secure.phabricator.com; secure; httponly Set-Cookie: phcid=phxz46g6yce5pwfg; path=/; domain=secure.phabricator.com; secure; httponly X-Frame-Options: Deny Strict-Transport-Security: max-age=0; includeSubdomains; preload Cache-Control: private, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip