It seems to work without setting `request.COOKIE['CSRFTOKEN']`.  I think because we are creating a mock request that doesn't go through django middleware, so the presence of that cookie is not checked (since that check's in CSRF middleware).

Actual CSRF protection (nonces in cookies) here is handled by shibboleth.  (The url to cause login is utterly predictable ('/shib-login/', but there is a series of POSTs and redirects handled by apache/mod_shib)