Mine seems to send both

Code:
X-Forwarded-For:
and

Code:
Client-Ip:
Both have the same value, which is my IP address.

As far as spoofing header information is concerned - yes, the client could put anything it wanted in that (or any other) header. So it should not be relied on for security.

Slarty