make sure both headers are set before checking for ip spoofing
Merge pull request #12410 from tamird/fix-ip-spoof-errors

Fix ip spoof errors