I got it to work by removing /kibana from the haproxy rules. I could see the initial get going through in the browser network debugger, but the login response is where it failed.
We'll see if my manager is happy removing /kibana. He's on PTO today.
Thanks for the help.