Code tweak + documentation fix

Hi Rintaro,

First off, thanks very much for your work.  :)  I was testing CSRFBlock today on an app which is being served via proxy. I had to make a small code change in order for $http_host to match in the regex.  The issue was that HTTP_HOST had ":443" appended to it.  Rather than strip out the port in $http_host, I opted to default it to HTTP_X_FORWARDED_HOST if it exists and then to fall back to HTTP_HOST.  

This fixed the issue for me.  Maybe someone else will find this helpful as well?

Best,

Olaf