Fixed forwarded address extraction.

According to the StackOverflow article referenced (and recent first hand experience), the user's IP comes first.