Thanks for your suggestions, I have updated the pull request accordingly.

Unfortunately 2. makes the code somewhat redundant. Both headers have to be checked twice (`X_FORWARDED FOR` because `explode` returns `array('')` if the second parameter is `''` and `X_REAL_IP` because the loop does not necessarily return something when all IPs in `X_FORWARDED_FOR` are in the whitelist).
I can't create a `check_proxy_whitelist()` function, because it would potentially be called many times for `X_FORWARDED_FOR` which is counterproductive if the call to `config->get()` is expensive. Creating a function for `get_proxy_whitelist()` hardly reduces complexity. I would be happy if you have ideas how to express the logic in a more elegant way.