ePPN and Shibboleth session ID => Shibboleth authentication?

Erm... As these variables are just sent upstream in the request headers,
rather than inherited from Apache, they could easily be spoofed to get a
token, provided one had access to the app. This security hole *could* be
firewalled, but it's easier (thus, safer) to just use the Perl script.