fix to support both client (for testing) and real external Shibboleth header