add nginx stub_status for internal network, fall back to localhost
respect X-Forwarded-For header for PyPI, trust everyone for now