Ok, I found the reason - the redirect to the login page does not work correctly. If I open up the url to /login instead of just the kibana-root-url, I get the login form.
However, the redirect after a successfull login does not work as well, but yields a similar loop. If I enter the app/home address manually I can indead access kibana. It is probably somehow connected to the rewriting of the location header in the combination kibana/Zuul-Gateway/ssl encryption...