nginx location match on ssl_client_verify

I'm trying to setup nginx to match certain URLs on servers granted conditional access (ie, only servers with valid client certificates can access the zone).

Currently, simple location blocking works well to prevent access by unauthorized users:

location ~ ^/protected/ticketing {
         if ($ssl_client_verify != SUCCESS) { return 401; }
#need treatment of php files here after SUCCESS = $ssl_client_verify ?!
}

So no one can access /protected/ticketing/anyThingHere

but. This return 401 is not triggered when you actually present a valid certificate, the upstream FPM server does not resolve /protected/ticketing/index.php, but serves it up for download (ie, sets the content-disposition to the default eight-bit bitstream).

Is there an elegant way to do this?

My upstream is defined as:

upstream backend {
server unix:/var/run/php5-fpm.sock;
}

PHP handler location block:

location ~ [^/]\.php(/|$) {
 fastcgi_split_path_info ^(.+?\.php)(/.*)$;
 if (!-f $document_root$fastcgi_script_name){return 404;}
 fastcgi_pass backend; #pass request to the upstream
 fastcgi_index index.php;
 include fastcgi_params;
}