Aha! This is in the response to the curl PROPFIND, not in the log.
The linked page, ownCloud Central, has patch info for lib/base.php that doesn’t really apply to the current version(s).
I can see the clinet is sending a header for Authorization: Basic, how can I see what owncloud is getting from apache?