Hrm... I think I see why, but how to fix?
So, in digging through the roundcube source I see this:
// check client X-header to verify request origin
if (empty($CONFIG['devel_mode']) && !rc_request_header('X-RoundCube-Referer'))
header('HTTP/1.1 404 Not Found');
And I changed that "die" line to spit out "ARGH" and sure enough that's the spot I'm hitting.
So, not knowing much about the code, I'm guessing that litespeed is stripping out the X-RoundCube-Referer header and that isn't making it into PHP.
Is there a way to make sure that gets passed in?