Fixed security hole

With this option enabled API "security" can be easily bypassed by supplying "X-Forwarded-For: 127.0.0.1" header