clarified that IP reverse proxy cache must be an untrusted proxy