Currently, Tailscale falls back to WebSocket if it sees a 4xx when trying to connect with Upgrade: derp. Some reverse proxies (like Azure Application Proxy) handle Upgrade: derp in a very silly way which circumvents this automatic detection and fallback to WebSockets (Azure redirects you to the login page?!?!?)

Add a server flag --derp-force-websockets to force all clients and agents to connect to every DERP server over websockets instead of trying Upgrade: derp first.