In audit log, use HTTP_X_FORWARDED_FOR for remote_addr, if it was provided