handle HTTP_X_FORWARDED_FOR