Add X-Forwarded-For header in proxy handler
Change from isUserInRole(String) to getRoles()