The logs are unhelpful, but some packet sniffing was. You were right, the filter was closing the connection. It seems that the filter API works fine with GETs, since it's set to by default. However, if you throw any other sort of request at it, it will close unless you return a DECLINED status to Apache, which makes it just pass the request to the next filter. So, you end up needing to specifically deal with every possible request

        # need to specify which options this can't deal with, or it wi
+ll bork things.
        # if a method is undealt with, must pass DECLINED to apache.
        if ($filter->r->method_number != Apache2::Const::M_GET &&
            $filter->r->method_number != Apache2::Const::M_PUT) {
                $filter->r->allowed($filter->r->allowed | (1<<Apache2:
+:Const::M_GET) | (1<<Apache2::Const::M_PUT));
                return Apache2::Const::DECLINED;

        # otherwise, we do want to do something with this request
        } else {
[download]

Unfortunately, the only place I could find this documented was under the r->allowed API documentation. Go figure.

Thanks much for the tips!