Improves the loopback auth. handling in working

Fixes a problem with the handling of IPv6 when checking for loopback
requests in ViewPage.action.

Adds a check for the header X-Forward-For when checking for loopback
requests in ViewPage.action.