Add RemoteIpValve with support for "x-forwarded-for" and "x-forwarded-proto" headers.
Using the default 'internalProxies' list (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) is acceptable because all the private addresses are trusted.