Do not inspect HTTP_X_FORWARDED_PROTO

Attacker could inject such headers, circumventing the SSL redirect. See #1.