use X-Forwarded-For with Deny