Handle x-forwarded-... headers. Fix browser redirect loop when access=secure
Correct changelog date