Do not inspect HTTP_X_FORWARDED_PROTO

Attacker could inject such headers, circumventing the SSL redirect. See #1.
Merge pull request #2 from Bouke/patch-1

Do not inspect HTTP_X_FORWARDED_PROTO