Javascript truthiness strikes again!

This allows missing headers, or `trustProxy` being `false`.