Enhance the verification to allow local access only

Currently if you use some services like pagekite to expose your local environment (through a public address) better_error will be enabled.
This is because only the header 'REMOTE_ADDR' is checked. 

This commit add a check also on 'HTTP_X_FORWARDED_FOR'.
(for example, this is done inside rack http://rack.rubyforge.org/doc/Rack/Request.html#method-i-ip)