X-Forwarded-For, don't leak the token