ARR IIS rewriting websocket (for Home Assistant)

Question

I've tried to set up a ARR internal rewrite for Home Assistant. Home Assistant currently only allows for a single password for logging in and I would like to do this via Windows Forms. So far, so good: the rewrite works, the login works, but I'm getting a 400-exception on the websockets, on which Home Assistant relies heavily.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
    <rewrite>
        <rules>
            <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                <match url="http://localhost/(.*)" />
                <conditions trackAllCaptures="true">
                    <add input="{REQUEST_URI}" pattern="^/login(.*)" negate="true" />
                </conditions>
                <action type="Rewrite" url="{C:1}://192.168.1.11:8123/{R:1}" logRewrittenUrl="true" />
            </rule>
            <rule name="ReverseProxyInboundRule2" stopProcessing="true">
                <match url="ws://localhost/(.*)" />
                <conditions>
                    <add input="{CACHE_URL}" pattern="^ws://" />
                </conditions>
                <action type="Rewrite" url="ws://192.168.1.11:8123/{R:1}" />
                <serverVariables>
                    <set name="HTTP_SEC_WEBSOCKET_EXTENSIONS" value="0" />
                </serverVariables>
            </rule>
        </rules>
    </rewrite>
</system.webServer>
<system.web>
    <authentication mode="Forms">
        <forms loginUrl="login.aspx" name=".ASPXFORMSAUTH">
        </forms>
    </authentication>
    <authorization>
        <deny users="?" />
    </authorization>
</system.web>

http works, but ws gives me a 400. Could anyone help me out? I'm using Windows Server 2012 with latest IIS and also using latest Home Assistant.