always set x-forwarded-proto and ssl to prevent malicious overwritting