Just an fyi, if you look in the htaccess files you'll see all requests are routed via framework/main.php - the index.php is really just there incase rewrite support is not available on your particular install of Apache.

I removed the following from .htaccess and all works fine for me now.
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

In your virtual hosts file /etc/apache2/sites-available/yoursite.conf

you might need this:

<Directory /var/www/yoursite>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>

the "AllowOverride All" is the important directive