Protecting a ScriptAlias'ed directory - get "Internal Server Error"

Greetings,

I think I've tracked this down to a behavior that only seems to pop up when I'm using mod_auth_vas. I have a cgi-bin directory that I am protecting with a <Location> directive (tried using <Directory> too with the same result):

ScriptAlias "/test/cgi-bin" "/usr/src/test"
<Location "/test/cgi-bin">
    AuthName "Nagios"
    AuthType VAS
    AuthVasUseBasic on
    AuthVasLocalizeRemoteUser on
    Require group "UNIX-Administrators"
</Location>

The result I get is "Internal Server Error" and:

[Thu Apr 26 13:00:09 2007] [error] [client 170.54.111.28] Premature end of script headers: test.cgi

in the error log. When I comment out the <Location> stanza, the test.cgi script works. If I use another auth module, it works. mod_auth_vas works for directories that are not ScriptAliased. I'm stuck at this point. Any ideas?

Thanks.