a security improvement, and other additions

- [SEC] Use trusted proxy values when determining IP from X-Forwarded-For. Thanks, @timoh6, for the report that led to this fix.

- [ADD] Convenience methods for HTTP-auth-related values: getAuthUser(), getAuthPw(), getAuthDigest(), getAuthType().
one fix, and two adds

- [FIX] PHP uses 'CONTENT_TYPE', not 'HTTP_CONTENT_TYPE', for the 'Content-Type' header value (per CGI spec)

- [ADD] Convenience methods getLength() and getMd5() for 'Content-Length' and 'Content-MD5' header values
too many optional constructor args; move them all to setters
modify tests for fixes, and 100% coverage