HTTP_X_FORWARDED_PROTO is bypassed

[cryptogun]

nginx + gunicorn:
1.
proxy_set_header X-Forwarded-Proto $scheme;
HTTP_X_FORWARDED_PROTO=None
No redirect.
2.
proxy_set_header X-Forwarded-Proto $scheme;
HTTP_X_FORWARDED_PROTO='httpssssssss'
No redirect.
3.
proxy_set_header X-Forwarded-Proto $scheme;
HTTP_X_FORWARDED_PROTASDF='httpssssssss'
No redirect.
4.
proxy_set_header X-Forwarded-Protooo $scheme;
HTTP_X_FORWARDED_PROTOOO='https'
No redirect.
5.
proxy_set_header X-Forwarded-Protooo $scheme;
HTTP_X_FORWARDED_PROTOOO=None
ERR_TOO_MANY_REDIRECTS
6.
Add an else clause under [these lines](​https://github.com/django/django/blob/master/django/http/request.py#L196-L197).

            else:
                return 'http'

And set:
proxy_set_header X-Forwarded-Proto $scheme;
HTTP_X_FORWARDED_PROTO='httpssssssss'
Chrome would report the expected ERR_TOO_MANY_REDIRECTS
Did someone forget to add the else clause, or there are 3 'http' 'ftp' and 'ftps' scheme left?
If a site use 5. An attacker may set request X-Forwarded-Proto header to bypass the HTTPS check and result in 1,2,3.