code: public boolean isTrusted(String hostAddr, String headerName) {
          if (!wcTrusted) {
              return false;
          }
          if (HttpHeaderKeys.isSensitivePrivateHeader(headerName)) {
              // if this is a sensitive private header, check trustedSensitiveHeaderOrigin values
              return isTrustedForSensitiveHeaders(hostAddr);
          }
          if (!usePrivateHeaders) {
              // trustedHeaderOrigin list is explicitly set to "none"
              return isTrustedForSensitiveHeaders(hostAddr);
          }
          if (restrictPrivateHeaderOrigin == null) {
              // trustedHeaderOrigin list is set to "*"
              return true;
          } else {
              // check trustedHeaderOrigin for given host IP
              boolean trustedOrigin = restrictPrivateHeaderOrigin.contains(hostAddr.toLowerCase());
              if (!trustedOrigin) {
                  // if hostAddr is not in trustedHeaderOrigin, allow trustedSensitiveHeaderOrigin to override trust
                  trustedOrigin = isTrustedForSensitiveHeaders(hostAddr);
              }
              return trustedOrigin;
          }
      }
docs: Check to see if the source host address is one we allow for specification of private headers
  
  This takes into account the hosts defined in trustedHeaderOrigin and trustedSensitiveHeaderOrigin.  Note,
  trustedSensitiveHeaderOrigin takes precedence over trustedHeaderOrigin; so if trustedHeaderOrigin="none"
  while trustedSensitiveHeaderOrigin="*", non-sensitive headers will still be trusted for all hosts.
  
  @param hostAddr The source host address
  @return true if hostAddr is a trusted source of private headers