Thank you for your reply, @Jineet_Vora.
I'm using the RESTClient plugin for Firefox. That addon helpfully outputs the equivalent `curl` command for the requests it sends. The curl command it provides in this case is:
curl -X POST -H 'Authorization: Basic XXXXXX' -i 'http://test-aem.company.com:4502/bin/dxml/upgrade/3xto4x'
(Note that I have replaced the real auth string with "XXXXXX" for posting here.)
When I run that command (now that I've read up on it and understand it better), it works fine. Until I can get the plugin to show me the HTTP of the request it's sending, I don't see a way to debug further. I'll just have to use curl.