Let's all have a good laugh at my expense...
when I access my URL at nodered.foo.bar (no port), the router forwards port 1880 for me. but leaves websockets in the dust.
when I access my URL at nodered.foo.bar:1880, well all the debug shows up.
I suppose I can live with that workaround and the embarassment of overlooking it.