Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Cantor, Scott]

> Just an FYI - you are stuck relying on headers if you are using
> the Tomcat connector for IIS. It does not pass server variables
> from IIS to the underlying Tomcat instance. 

I cannot commit to supporting headers permanently. I'm not removing it immediately, but the feature will be gone at some point down the road, it's simply not safe.

Switch to Apache if that's your use case.

-- Scott