I have stumbled on a solution, but to be honest, I do not understand the reason. I have been able to confirm that using php5-fpm with proxy_fcgi is the cause of authorisation issues, resulting in Lightning not being able to connect correctly to the NC server. Reverting to mod_fastcgi resolves the problem, but it seems NC devs are aware of this, and add relevant use cases into the .htaccess file. Unfortunately this still does not resolve the problem. Eventually I stumbled on an incantation that resolves this, using a proxy directive ahead of a SetHandler directive, and with this, mod_proxy_fcgi option with php5-fpm works for Lightning, as before.
The way I have done this is to add and enable a “php5-fcgi.conf” with the following
<Proxy “fcgi://localhost:9000/”>
<FilesMatch .php$>
SetHandler “proxy:fcgi://localhost:9000”
I would prefer to be using a socket, but this is acceptable.
Hope this helps someone.