Add HTTPS detection via X-Forwarded-Proto

Similarly to `X-Forwarded-For`, `X-Forwarded-Proto` should also be taken into account when parsing the request object. One thing that stands out is that there is no whitelist support for filtering out spoofed values for `X-Forwarded-For`. Would you be open to integration with a more robust implementation such as [forwarded-for](https://www.npmjs.org/package/forwarded-for)?