make sure both headers are set before checking for ip spoofing

In my routing stack, HTTP_CLIENT_IPS is getting set, but HTTP_X_FORWARDED_FOR is not, and this check is blowing up.

This PR adds tests and fixes the underlying problem.