also allow X-Fowarded-User header