Found it.. first, I needed to use requests.Session(). It looks like this persists cookies, which was upsetting HANA.
There was also a bug in my payload, I was doing json.dumps, which wasn't necessary.
John
#! /usr/bin/python
import requests
import json
s = requests.Session()
#s.auth ('User','Password')
s.headers.update({'Connection': 'keep-alive'})
params= { 'X-CSRF-TOKEN': 'Fetch' }
auth= 'SYSTEM','Fr33B33r'
r=s.get('http://localhost:8000/sap/hana/rdl/odata/v1/rca_demo/rca_demo',auth=auth,params=params)
#params = { 'X-CSRF-TOKEN': r.headers['x-csrf-token'] }
token = r.headers['x-csrf-token']
print token
url='http://localhost:8005/sap/hana/rdl/odata/v1/project/subproject/entity'
payload='{ "customerId": 15, "firstName": "John", "lastName": "Appleby"}'
headers= {'Content-type': 'application/json;charset=utf-8', 'X-CSRF-TOKEN': token}
r2=s.post(url, data=payload, headers=headers, auth=auth)
print headers
print r2.url
print r2.headers
print r2.text