Check x-forwarded-for header for real ip address.
Only allow 'tor' team.