bucket policy: use X-Forwarded-For instead of peer

> If riak-cs is behind a load balancer or reverse proxy, we should be looking for the IP address from a header, like [X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For). How about two app.config settings

from Reid's comment: https://github.com/basho/riak_cs/pull/364#discussion_r2543118