Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.