Title: Ignore X-Forwarded-For unless client IP is in approved ACL of CIDR blocks

Description: The issue with relying on X-Forwarded-For is that those can be forged easily. If there was a way to restrict the existing X-Forwarded-* headers so they only applied to certain IP ranges that would be great. If we could have a built-in option to dynamically load IP ranges from CloudFlare upon start (with a refresh once a week) that would be a really fantastic solution.

[optional Relevant Links:]
https://datatracker.ietf.org/doc/html/rfc7239
https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/
https://www.cloudflare.com/ips/