add comment

Author: Vladimir Kotal

opengrok-web/src/main/java/org/opengrok/web/api/v1/filter/IncomingFilter.java

@@ -116,6 +116,8 @@ public void filter(final ContainerRequestContext context) {
             return;
         }
 
+        // In a reverse proxy environment the connection appears to be coming from localhost.
+        // These request should really be using tokens.
         if (request.getHeader("X-Forwarded-For") != null || request.getHeader("Forwarded") != null) {
             logger.log(Level.FINEST, "denying request to {0} due to existence of forwarded header in the request",
                     path);