alter fake header sent to server

We are faking (if debug) the header sent to server, which will
then ignore usual authentication and beleive whoever we tell it
is logged in.  This only works when in debug on server, but
its still dangerous.  Adding here to try and narrow down session bug
Follow the RFC on naming header conventions

otherwise servers will cause case/escaping issues
Merge branch 'atc' into redirect-logout-to-root