FastCGI has "parameters" and HTTP headers are special parameters starting with "HTTP_" (mimicking CGI's environment variables). All parameters not starting with "HTTP_" can be trusted because only the web server (= FastCGI client) can construct them.

Unfortunately, it appeared too late, and the relevant support is now far less complete than that for `X-Forwarded-*`.