fixed access check

allow local link addresses and prevent access when XFF is set (the same as in app_dev.php)