Fixed security hole

With "trust proxy" option enabled API "security" can be easily bypassed by supplying "X-Forwarded-For: 127.0.0.1" header