X-Remote-User must be blocked at the toplevel apache

[merge]