make sure both headers are set before checking for ip spoofing

In my routing stack, `HTTP_CLIENT_IPS` is getting set, but `HTTP_X_FORWARDED_FOR` is not, and this check is blowing up.

This PR adds tests and fixes the underlying problem.