add req.secure tests
add support for multiple X-Forwarded-Proto values. Closes #1646