You might want to trust X-Forwarded-For too, as the unattended controller does iirc.