Ensure we can fake the user header

we want to be able to pretend a user is logged in via a simple
http header, so its easy to go around openid for dev
Adjust checking of fake headersto avoid clash with session
Zombie lines must die
redirect index to atc page
pep8
zombie lines - this time more serious

I think we can hand wave this but the folder should return full json obj
Put back the session cookie setter.

I managed to zombie line myself in 5 commits
small code cleanup
Merge branch 'master' into fake-user-header-in-wsgi