docs: public boolean isTrusted(String hostAddr, String headerName) {
          if (!wcTrusted) {
              return false;
          }
          if (HttpHeaderKeys.isSensitivePrivateHeader(headerName)) {
              // if this is a sensitive private header, check trustedSensitiveHeaderOrigin values
              return isTrustedForSensitiveHeaders(hostAddr);
          }
          if (!usePrivateHeaders) {
              // trustedHeaderOrigin list is explicitly set to "none"
              return isTrustedForSensitiveHeaders(hostAddr);
          }
          if (restrictPrivateHeaderOrigin == null) {
              // trustedHeaderOrigin list is set to "*"
              return true;
          } else {
              // check trustedHeaderOrigin for given host IP
              boolean trustedOrigin = restrictPrivateHeaderOrigin.contains(hostAddr.toLowerCase());
              if (!trustedOrigin) {
                  // if hostAddr is not in trustedHeaderOrigin, allow trustedSensitiveHeaderOrigin to override trust
                  trustedOrigin = isTrustedForSensitiveHeaders(hostAddr);
              }
              return trustedOrigin;
          }
      }