r000t, 
YOUR MASTODON SECURITY UPDATES (probably) AREN'T (quite) DONE YET
There were changes to the default nginx conf. This obviously doesn't get updated when Mastodon does.
Just add these lines to your nginx configs. Reload nginx. You're done.
https://github.com/mastodon/mastodon/commit/fed9cbfd2ba8db8bffb03f554c24d83b6f8aa059 #mastoadmin