Accept the proxy user header only from trusted addresses

In proxy mode, each client that reached the port could send the user
header. PROXY_AUTH_TRUSTED_IPS now lists the addresses and networks that
can send it. The default is the loopback and private addresses, so a
request that comes straight from the internet cannot log in.

tests/test_config.py

@@ -97,6 +97,7 @@ def test_defaults(monkeypatch, reload_config):
         "DEFAULT_LOCKED_FIELDS",
         "LOG_LEVEL",
         "PROXY_AUTH_USER_HEADER",
+        "PROXY_AUTH_TRUSTED_IPS",
         "SESSION_COOKIE_SECURE",
         "TRUST_PROXY",
         "CWA_DB_PATH",
@@ -113,6 +114,15 @@ def test_defaults(monkeypatch, reload_config):
     assert config.DEFAULT_LOCKED_FIELDS == ["title"]
     assert config.LOG_LEVEL == "INFO"
     assert config.PROXY_AUTH_USER_HEADER == "X-Remote-User"
+    assert config.PROXY_AUTH_TRUSTED_IPS == [
+        "127.0.0.0/8",
+        "::1",
+        "10.0.0.0/8",
+        "172.16.0.0/12",
+        "192.168.0.0/16",
+        "fc00::/7",
+        "fe80::/10",
+    ]
     assert config.SESSION_COOKIE_SECURE is False
     assert config.TRUST_PROXY is False
     assert config.CWA_DB_PATH is None