Make it so basic auth requests get the json page.
Tweak csrf session timeouts
Don't remove existing headers, they are needed.
Calculate the persona assertion as this will be needed when bdd tests are added.
persona tests