Skip invalid ip's given in http headers

Do not use `HTTP_X_REAL_IP` or `HTTP_X_FORWARDED_FOR ` if the given ip in those headers is reserved, and not publicly routable.

I just reused the loopback detection code, but ideally this should check for all the possible reserved cases:

http://en.wikipedia.org/wiki/Reserved_IP_addresses