fixes to support alternate REMOTE_USER method using HTTP header