Rather than this being an option, you should just always set xfo to deny