Thanks for the pointer. While I needed that option set, I also had to enable the checkbox for WebGUI redirect (System–>Advanced).
BTW - A huge shout-out to the pfSense technical support team. After struggling with this for a few hours, I opened a ticket and immediately had a couple of great engineers on the phone (maybe 2min wait at most). Brandon and Chris helped figure out the problem in short order as well as clear up some questions about CARP, NAT, and NAT Reflection. Thanks guys!