I can't really see any pattern that suggests we can reliably discern HTTP headers from shib headers. Actually, I bet some day this mess of un-namespaced parameters is going to bite us.

Can we configure mod_shib to namespace headers that came from Shib?

In any case, lets just call the `profile` object `headers` and let the `verify` method take what it needs, knowing all it is is a jumble of request headers.