Allow whitelisting the CDN for trusting the X-Forwarded-* headers

This fixes #256

This will require config changes @ewdurbin.