deny rule is not filtering entirely
Solution 1:
This is a guess, but in the config, passenger_enabled on; is on the server level.
It is possible that this captures the requests.
Try removing the line from server level and add:
location / {
passenger_enabled on;
}