Some different configurations were attempted as well. Notably, sending header_upstream Origin '' or header_upstream Referer '' resulted in 401s for the index document!
Given that the discussions on their Github indicated the Origin and Referer headers needed to be surpressed, and that the X-Forwarded-Host needed to match what was seen in the browser, the configuration I ended up with fully working was this:
The port (443 above, as I used standard HTTPS during these tests) needs to match the port shown in the browser, so a working config for you will likely be: