Auth request: fix body handling again. Setting r->discard_body is wrong way to go as it causes lingering timer to be armed on subrequest finalization. Create fake body instead. This also allows to protect real body file from being closed in case it was already read. Though it doesn't matter now as we set r->header_only and relevant code in ngx_http_upstream_send_response() isn't reached.