Better IP address detection for trusted networks

Add a configuration option for whether or not to fall back onto
local IP address if SSH_CONNECTION or PAM_RHOST is not available

Only use PAM_RHOST if it is actually an IP address, not a hostname. A user can
force PAM_RHOST to be an IP, by setting UseDNS to 'no' in their SSH config, for
ssh logins, at least. Other than that, PAM_RHOST is set by the authenticating
client application, and settings would be application specific. For example,
sudo doesn't pass anything in at all.

Don't attempt to do any hostname->ip lookups, because ISPs and DNS suck.

Make the new configuration options be lowercase with underscores
Update CHANGELOG, man pages for the rest of 1.9.4