add csrf test; disambiguate proxy/native client ip