Fix remote IP, fix title

frontend/nginx.conf.example

@@ -26,12 +26,17 @@ server {
 
     # Reverse proxy the API to the Go service. Keeping the same origin means
     # the session cookie (SameSite=Lax) and CSRF cookie work without CORS.
+    #
+    # X-Forwarded-For uses $remote_addr (the immediate peer) so a client cannot
+    # spoof its recorded session IP; the backend trusts the leftmost value. If
+    # this nginx sits behind another trusted proxy, use $proxy_add_x_forwarded_for
+    # and make the backend read the appropriate hop instead.
     location /api/ {
         proxy_pass http://127.0.0.1:8080;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }