fix(bastion): capture X_FORWARDED_FOR correctly

The WSGI standard specifies that all HTTP-provided headers are
prefixed with 'HTTP_'. This patch makes it so that we try to match
against HTTP_X_FORWARDED_FOR rather than X_FORWARDED_FOR.

Tests are updated.