Prevent malicious overwriting of x-forwarded-proto and ssl

We have made an improvement over our last pull request about the X-Forward-Proto and -Ssl. 
With the previous nginx configuration it was possible that a malicious user can send the headers himself and force the app thinking that the connection was made via https where in fact it was not. This is now prevented by always setting the header in nginx, and thus overwriting any user sent headers.
Further we improved how the scheme and ssl flag is set resulting in a cleaner configuration.