client IP checks optional, support X-Forwarded-For