@eleijonmarck does it make sense to have `X-Forwarded-Proto` and `X-Forwarded-Port` in this example? `csrf.go` is comparing these header's values against the origin - and, based on my understanding, these two will never match. 