alter fake header sent to server

We are faking (if debug) the header sent to server, which will
then ignore usual authentication and beleive whoever we tell it
is logged in.  This only works when in debug on server, but
its still dangerous.