auth: fix `x-forwarded-for` hold

I still think we must not call `next()` here.