You can pass the Authorization header as Joe suggests using an nginx proxy.
Here is the relevant section of my nginx.conf:
 server {
     listen       4443 ssl; # the default was port 443
     server_name  tim-virtual-machine.local;
     ssl_certificate      /home/tim/domain.crt;
     ssl_certificate_key  /home/tim/domain.key;
     ssl_session_cache    shared:SSL:1m;
     ssl_session_timeout  5m;
     ssl_ciphers  HIGH:!aNULL:!MD5;
     ssl_prefer_server_ciphers  on;
     location / {
         proxy_set_header  Host $host;
         proxy_set_header  X-Real-IP $remote_addr;
         proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header  Authorization "Basic cGFudHM6b25maXJl"; # base64-encoded username:password to pass in header
         proxy_pass  https://tim-virtual-machine.local:5601; # actual kibana URL
     }
 }
I got this mostly from following this tutorial: http://shairosenfeld.blogspot.com/2011/03/authorization-header-in-nginx-for.html
I generated the Base64 string out of the username:password combination with this unix one-liner:
echo -n username:password | base64