auth: fix `x-forwarded-for` hole

I still think we must not call `next()` here.