This introduces a security vulnerability as any client can now fake any IP by populating this header, imo you should just remove this option and always overwrite X_Forwarded_For with REMOTE_ADDR.