req.secure: check first comma-delimited protocol

[jonathanong]

Currently, my request headers look like this:

  'x-forwarded-for': '24.205.165.76,127.0.0.1',
  'x-forwarded-proto': 'https,http',
  'x-forwarded-port': '32220' 

But this doesn't work with req.secure as it currently assumes there's only one proxy.

Also, there are no tests for req.secure, so I don't know how to add a test.

[jonathanong]

i don't know if this introduces security risks (i don't know enough about proxies).

@visionmedia if this is the correct way to fix this, you would also want to fix https://github.com/senchalabs/connect/blob/master/lib/middleware/cookieSession.js#L94

[tj]

yeah you're right, I'll add some tests and soften the whitespace restriction

[jonathanong]

same fix is required in connect's cookie session. not sure where else.