auth: fix `x-forwarded-for` hold