The IAM person brings in their senior. We eventually get something working after they iterate through their XML configs and remappings.

It turns out that the WAF has been set to filter out any header with a _ in it.