fix to prevent IP spoofing if you don't trust X-Forwarded-For HTTP header