fixed possible flaw in X-FORWARDED-FOR