This logic seems backwards? 

My understanding is that: if X-Forwarded-For is present, then it should be forbidden, because that means it came from a frontend rather than from local access on the machine.  In that case, shouldn't it be `ok` instead of `!ok`?