optionally use X-Forwarded-Proto
optionally allow cleartext loopback requests