req.secure: check first comma-delimited protocol

Currently, my request headers look like this:

```js
  'x-forwarded-for': '24.205.165.76,127.0.0.1',
  'x-forwarded-proto': 'https,http',
  'x-forwarded-port': '32220' 
```

But this doesn't work with `req.secure` as it assumes there's only one proxy. 

Also, there are no tests for `req.secure`, so I don't know how to add a test.