We don't want to trust `X-Forwarded-For` unless we're validating it. (Clients can set it, and it can be a list.) We ha<del>ve</del><ins>d</ins> `SetRemoteAddressFromForwardedFor` middleware somewhere. That never worked because it implemented (or tried to, anyway) a complicated algorithm that was supposed to work with our specific set up.

Let's talk to IT and see if we can trust X_CLUSTER_CLIENT_IP or X_FORWARDED_FOR. It's possible that the rules have changed since Dave first walked me through that.