This is a follow-up from the issue 3974.
TL;DR:
On a freshly installed Kibana with no proxy here's what I get :
$ curl -i 127.0.0.1:5601
HTTP/1.1 401 Unauthorized
More info on github, with straces / netstat / curls, and so on. I also tried a lot of node debug but as I'm not a javascript developper it's quite hard for me to locate an interesting part in the code behind all those mixed-up callbacks hiding tracebacks )o:.