OK, I just tracked this down to whether the proxy_pass value refers to a load-balancing upstream collection (as I'm doing above) vs. a hard-coded reference to one server. So, if I change the proxy_pass config value to refer to http://download.foobar.com instead of http://download_servers, everything works.

Is this a known limitation, or a bug that I should file?