clarified that IP of reverse proxy cache must be an untrusted proxy

I've noticed that when securing ESI routes by IP, one must not have the IP of the reverse proxy cache as a trusted proxy, otherwise the original request IP (or a non trusted proxy IP) would be the one being matched against the ACL rule instead.