add an option to not use the real source header, and change is_ssl() to ignore it