ref #101: if availabe, use X-Forwarded-For header instead of request.remote_addr for the session protectin id