actually enable x-forwared-* parsing
remove forced HTTPS downgrading