rproxy passes the app the client's AS number and country by default (closes #379)

SWW_WAF_ADD_LOOKUP_HEADERS now defaults to true, so the app gets
X-Client-ASN and X-Client-Country with no setting. While
SWW_WAF_LOOKUP_SOURCE is off it defaults to false, so turning lookups
off alone still starts; true set with the lookup off still stops the
start. With GeoJS, a new client's first request now waits for its
answer, up to SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS.

Model: opus-5-5

SPEC.md

@@ -161,16 +161,16 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
    (`deny_nets`); a client in both lists is let through.
 5. Bans. A client under a ban is refused (`active_ban`; see "Bans").
 6. The lookup, unless `SWW_WAF_LOOKUP_SOURCE` is `off` (see "Lookup of AS number
-   and country"). The request goes on at once. It waits for the first GeoJS
-   answer, up to `SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS`, only when one of
-   these needs it:
+   and country"). The request waits for the first GeoJS answer, up to
+   `SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS`, when one of these needs it:
+    - `SWW_WAF_ADD_LOOKUP_HEADERS`, which is `true` by default;
     - the country list;
     - a biased threshold;
     - `SWW_WAF_TAG_DENY` or `SWW_WAF_TAG_LIMIT_PERCENT` naming an `asn=` or
-      `country=` tag;
-    - `SWW_WAF_ADD_LOOKUP_HEADERS`.
+      `country=` tag.
 
-    A request that ends before the answer comes is logged without it.
+    Otherwise the request goes on at once. A request that ends before the answer
+    comes is logged without it.
 
 7. The country list (`countries`; see "Country list").
 8. The reputation sources (see "Reputation"), in this order:
@@ -197,10 +197,10 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
 16. A path under `/_sww/` is answered `404`, so that the app never sees that
     prefix.
 17. `rproxy` passes the request to `SWW_RPROXY_UPSTREAM_URL`, streaming (see
-    "Passing a request to the app"). With `SWW_WAF_ADD_LOOKUP_HEADERS`,
-    `X-Client-ASN` and `X-Client-Country` are added for the app's own logs; a
-    header whose value is unknown is left out. Whatever that setting says, any
-    such header the client sent is removed.
+    "Passing a request to the app"). While `SWW_WAF_ADD_LOOKUP_HEADERS` is
+    `true`, as by default, `X-Client-ASN` and `X-Client-Country` are added for
+    the app's own logs; a header whose value is unknown is left out. Whatever
+    that setting says, any such header the client sent is removed.
 18. After the visitor's answer has ended, `rproxy` sends the report (see "The
     report"). `waf` then counts:
     - For a request it allowed, the body bytes of the response, of the request
@@ -2373,9 +2373,9 @@ runs no check, writes no request log line and counts nothing in the metrics.
 answer but the last below carries `X-Sww-Disposition`.
 
 - `X-Sww-Disposition: allow`, status `200`, no body. `rproxy` passes the request
-  to the app. With `SWW_WAF_ADD_LOOKUP_HEADERS` the answer also carries
-  `X-Client-ASN` and `X-Client-Country`, which `rproxy` adds to the request it
-  passes on. A header whose value is unknown is left out.
+  to the app. While `SWW_WAF_ADD_LOOKUP_HEADERS` is `true`, the answer also
+  carries `X-Client-ASN` and `X-Client-Country`, which `rproxy` adds to the
+  request it passes on. A header whose value is unknown is left out.
 - `X-Sww-Disposition: deny`, with the status, headers and body the visitor is to
   get. `rproxy` gives them to the visitor, less this header. The status is one
   of: