Nginx Secure Link with ProxyCache secure_link+secure_link_md5

We've set up a server to work as frontend "CDN". I think the issue has to do with $uri not being the same as the $path in the php code to generate it but I'm probably approaching this the wrong way. If I take off the srv1 and just set it to location / I stop getting 403 forbidden. What defines where the files get served on the backend servers is the X-Pull header I send.

location /srv1/ {
secure_link $arg_md5,$arg_expires;
secure_link_md5 "$secure_link_expires$uri VERYVERYSECRET";
if ($secure_link = "") { return 403; }
if ($secure_link = "0") { return 410; }
slice             10m;
proxy_cache       mycache;
proxy_cache_key   $uri$is_args$args$slice_range;
proxy_set_header  Range $slice_range;
proxy_set_header X-Pull "VERYVERYSECRETTOROUTETOCORRECTPATHONFILESERVER";
proxy_cache_valid 200 206 1h;
proxy_pass http://FILESRV1.SERVER.COM:80; #backend server srv1
proxy_cache_valid any 3600m;
     }
location /srv2/ {
secure_link $arg_md5,$arg_expires;
secure_link_md5 "$secure_link_expires$uri VERYVERYSECRET";
if ($secure_link = "") { return 403; }
if ($secure_link = "0") { return 410; }
slice             10m;
proxy_cache       mycache;
proxy_cache_key   $uri$is_args$args$slice_range;
proxy_set_header  Range $slice_range;
proxy_set_header X-Pull "VERYVERYSECRETTOROUTETOCORRECTPATHONFILESERVER";
proxy_cache_valid 200 206 1h;
proxy_pass http://FILESRV2.SERVER.COM:80; #backend server srv2
proxy_cache_valid any 3600m;
     }

this is how we're generating the secure link

    function buildSecureLink($baseUrl, $path, $secret, $ttl)
{
    $expires = time() + $ttl;
    $md5 = md5("$expires$path $secret", true);
    $md5 = base64_encode($md5);
    $md5 = strtr($md5, '+/', '-_');
    $md5 = str_replace('=', '', $md5);

    return $baseUrl . $path . '?md5=' . $md5 . '&expires=' . $expires;
}

// example usage
$secret = 'VERYVERYSECRET';
$baseUrl = 'http://edgeserver.cdn.com/srv1/'; //or srv2 wherever we know the file is... srv1 = filesrv1.server.com, srv2=filesrv2.server.com and so on...  
$path = '/file.bin';
$ttl = 3600; //no of seconds this link is active
echo buildSecureLink($baseUrl, $path, $secret, $ttl);