An App can trust every x-runtime-* header it reads (private beta)

The router removes every x-runtime-* header a visitor sends, on HTTP/1.1 and HTTP/2, before it adds its own: the visitor's address, country, city and the request's id. A visitor can no longer make up a header in that namespace and have it reach an App. See what an App's requests carry.