Add get_ident method to BaseThrottle class

This pull adds a `get_ident` method to the `BaseThrottle` class. This function is used to determine the identity of a request and will use `X_FORWARDED_FOR` and `REMOTE_ADDR` in that order to determine the identity of the machine making the request.

This fixes an issue where `UserRateThrottle` and `ScopedRateThrottle` use `REMOTE_ADDR` over `X_FORWARDED_FOR` to determine machine identity. This will not work if you are behind a proxy (like a load balancer). Using `X_FORWARDED_FOR`, if available, will fix this. This pull also solves a vulnerability, see the edit below.

`get_ident` will:
* Try to use `X_FORWARDED_FOR` first
* Fall back to `REMOTE_ADDR`


Edit:
This also fixes a possible vulnerability caused by using the entire `HTTP_X_FORWARDED_FOR` string. If an attacker is using one or more anonymous proxies when making requests against a DRF2 API he is able to change the `HTTP_X_FORWARDED_FOR` string in one of the proxies. 

In the following case:
```
HTTP_X_FORWARDED_FOR = "client1, anon_proxy1, anon_proxy2, application_proxy, application_server"
```
Only `anon_proxy2` should be trusted, because it is added by `application_proxy` (which we trust because it is a part of our application). If we trust `client1` or `anon_proxy1` we open up a vulnerability in which `anon_proxy2` changes the `HTTP_X_FORWARDED_FOR` value and it now looks unique to the server, and will bypass the throttle.

This vulnerability can be found here: https://github.com/tomchristie/django-rest-framework/commit/2d5e14a8d39a53c8a2e6d28fb8ae7debb5fbd388