well, one can argue can you can only trust the proxy if the forwarded_for option is set to true (which is the default). If you turn off this option, then, the proxy cannot be trusted anymore, so theere is no security issue if everything is configured as it should be. As setting this option to false is probably not a common case, I'm going to remove this option.