t3a-members.php: Check REMOTE_ADDR instead of proxy header

public/services/t3a-members.php

@@ -16,12 +16,12 @@ if (empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && empty($_SERVER['HTTPS'])) {
     header('HTTP/1.0 403 Forbidden');
     die('Not using HTTPS');
 }
-if (isset($apiKeys[$_SERVER['HTTP_X_FORWARDED_FOR']]) && $apiKeys[$_SERVER['HTTP_X_FORWARDED_FOR']] === $_GET['apiKey']) {
+if (isset($apiKeys[$_SERVER['REMOTE_ADDR']]) && $apiKeys[$_SERVER['REMOTE_ADDR']] === $_GET['apiKey']) {
     echo printAssociationMembers();
 } else {
     syslog(
         LOG_NOTICE,
-        't3a-members.php: API key for remote address ' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ' not found or invalid.'
+        't3a-members.php: API key for remote address ' . $_SERVER['REMOTE_ADDR'] . ' not found or invalid.'
     );
     header('HTTP/1.0 403 Forbidden');
     die('Invalid token');