fix: only trust X-Forwarded-* headers from trusted_addresses

fix: only trust X-Forwarded-* headers from trusted_addresses #11629