clarified that reverse proxy cache IP must not be a trusted proxy when securing ESI routes by IP