old method sometimes, filter cookie/auth, use HTTP_FORWARDED_COUNT
old method now used for appcache or browser-policy with disallowInlineScripts()
proxyCount deprecated in favour of HTTP_FORWARDED_COUNT env variable