@teotwaki - is the PROXY header sent in clear, before establishing the tls connection? If yes, then do it after accept.
Regarding the patch referenced above, I haven't looked extensively at the code parsing the proxy header, but adding the new parameter looks good.