support ip lists in X-Forwarded-For headers

Fixes #647 and revises #655