make sure both headers are set before checking for ip spoofing