Mention spoofing risks of X-Forwarded-For