Nginx RTMP with on_play PHP auth

Question

I am having problem with the authentication part when user playing my streaming. I want only people who have registered to be able to play the streaming.

I am using the "on_play" directive in my nginx.conf setting. Can anyone point out where do i go wrong? It never actually call the auth page.

My setting... 192.168.10.207 is my streaming server 192.168.50.160 is my authentication server (my PC)

I am using clappr player... and as the source i did

http://192.168.10.207/hls/stream.m3u8?username=rain&usertoken=397b57b2fe832bc18ff8318465fdc1c0

auth.php

$secret_key = "testkey123";
$username  =   $_POST['username'];
$usertoken    = $_POST['usertoken'];

$mytoken = strtolower(md5($username.$secret_key));

if ($token == $mytoken){
  header("HTTP/1.1 202 Accepted");
}else{
  header("HTTP/1.1 403 Forbidden");
}

nginx.conf

rtmp {
        server {
                listen 1935;
                chunk_size 8192;
                notify_method get;

                application hls {
                        live on;
                        meta copy;
                        hls on;
                        hls_fragment 1;
                        hls_playlist_length 2s;
                        hls_path /tmp/hls;
                        record off;
                        on_publish http://192.168.10.207/auth;    #protect uploading
                        on_play http://192.168.50.160/zeus/TP/auth;    #protect when playing
        }
    }
}