I could not get the Lightspd cgi component to work properly until I enabled the auth module and set a username and password on the cgi-bin directory. BackupPC uses the REMOTE_USER env to check if you are logged in.

To set this up I uncommented the "mod_auth" line and added
<file>
auth.backend               = "plain"
auth.backend.plain.userfile = "/ffp/etc/lighttpd.user"

auth.require               = ( "/cgi-bin" =>
                               (
                                 "method"  => "basic",
                                 "realm"   => "BackupPC",
                                 "require" => "valid-user"
                               )
                             )
</file>

The lighttpd.user file is simply a USERNAME:PASSWORD style

Some good info at:

http://www.cyberciti.biz/tips/lighttpd-setup-a-password-protected-directory-directories.html

http://solstice.eplt.washington.edu/LighttpdConfig