a. In passport land this is usually done if you have `_passReqToCallback` in the options.
b. We should probably do this regardless
c. At this point we don't know what headers we care about yet, that's the responsibility of the verify function, we simply need to pass all attributes. We could do the inverse and strip all http-related headers off?

For reference, this is what you get from the testshib idp:
``` javascript
{
      "host": "oae.oae-performance.oaeproject.org",
      "x-real-ip": "131.111.184.30",
      "x-forwarded-for": "131.111.184.30, 127.0.0.1",
      "x-nginx-proxy": "true",
      "cache-control": "max-age=0",
      "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
      "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.149 Safari/537.36",
      "dnt": "1",
      "accept-encoding": "gzip,deflate,sdch",
      "accept-language": "en-US,en;q=0.8,nl;q=0.6",
      "cookie": "_ga=GA1.2.1712622911.1392371094; _shibsession_64656661756c7468747470733a2f2f736869622d73702e6f61652d706572666f726d616e63652e6f616570726f6a6563742e6f72672f73686962626f6c657468=_a60f3b183d218ad23ef5fd6b4be53e95; connect.sess=s%3Aj%3A%7B%22passport%22%3A%7B%7D%7D.EhTEsaH%2FV59znqFRThD7cLN7CuegFzBa8s%2FIlqcT4Qs; _shibsession_6f61652e6f61652d706572666f726d616e63652e6f616570726f6a6563742e6f726768747470733a2f2f736869622d73702e6f61652d706572666f726d616e63652e6f616570726f6a6563742e6f72672f73686962626f6c657468=_c7593b5b92527269d315f5d1d9846aeb",
      "shib-session-id": "_c7593b5b92527269d315f5d1d9846aeb",
      "shib-session-index": "_81c756cd1c12e670e3e8eae1c4738bbc",
      "shib-identity-provider": "https://idp.testshib.org/idp/shibboleth",
      "shib-authentication-method": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
      "shib-authentication-instant": "2014-03-18T19:31:43.777Z",
      "shib-authncontext-class": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
      "shib-authncontext-decl": "",
      "shib-assertion-count": "",
      "eppn": "alterego@testshib.org",
      "affiliation": "Member@testshib.org",
      "unscoped-affiliation": "Member",
      "entitlement": "urn:mace:dir:entitlement:common-lib-terms",
      "targeted-id": "",
      "persistent-id": "https://idp.testshib.org/idp/shibboleth!https://shib-sp.oae-performance.oaeproject.org/shibboleth!DULE9z3R/Ib+q3q9RekKl5tcS+U=",
      "primary-affiliation": "",
      "nickname": "",
      "primary-orgunit-dn": "",
      "orgunit-dn": "",
      "org-dn": "",
      "assurance": "",
      "member": "",
      "educourseoffering": "",
      "educoursemember": "",
      "cn": "Alter Ego",
      "sn": "Ego",
      "givenname": "Alter",
      "mail": "",
      "telephonenumber": "555-5555",
      "title": "",
      "initials": "",
      "description": "",
      "carlicense": "",
      "departmentnumber": "",
      "employeenumber": "",
      "employeetype": "",
      "preferredlanguage": "",
      "displayname": "",
      "manager": "",
      "seealso": "",
      "facsimiletelephonenumber": "",
      "street": "",
      "postofficebox": "",
      "postalcode": "",
      "st": "",
      "l": "",
      "o": "",
      "ou": "",
      "businesscategory": "",
      "physicaldeliveryofficename": "",
      "shib-application-id": "oae.oae-performance.oaeproject.org",
      "remote_user": "https://idp.testshib.org/idp/shibboleth!https://shib-sp.oae-performance.oaeproject.org/shibboleth!DULE9z3R/Ib+q3q9RekKl5tcS+U=",
      "via": "1.1 oae.oae-performance.oaeproject.org",
      "x-forwarded-host": "oae.oae-performance.oaeproject.org",
      "x-forwarded-server": "oae.oae-performance.oaeproject.org",
      "connection": "Keep-Alive"
    }
```