perfer X-Forwarded-Proto to prevent users lying

[haarg]

X-Forwarded-Proto should be the preferred header to used to check if the
front end connection was HTTPS. Proto is the de facto standard for
this, and is recommended in the deployment documentation.

If the -Protocol header is checked first, that means most setups that
only add a -Proto header will pass through a user provided -Protocol
header, allowing users to lie about the protocol used.

Ideally this would only check one header, and the reverse proxy would be
required to send that header. Leaving this with the fallback behavior
for now for backwards compatibility.

[bigpresh]

This looks reasonable to me!

See also #590 for a very old, much more in-depth consideration of behind-proxy stuff - but I think this has value in being merged now as a quick improvement.

Mozilla agree - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto describes -Proto as "a de-facto standard header", and mentions -Protocol under "Other non-standard forms", so that's enough as far as I'm concerned to accept that, yes, we should look for -Proto first, as it's the most likely one.

[xsawyerx]

👍