After enabling verbose logging on the Polarion server, I saw it was failing due to a 'missing start boundary' error. So, turns out that setting the 'Content-Type' in the header manually messes the request up. Removing that solved the problem.