be selective about forwarded headers, and test that it works with conjurops account