new: extract X-Forwarded-For original client IP from HTTP headers