fixed access check: allow local link addresses and prevent access when XFF/HTTP_CLIENT_IP is set
merged branch bes89/update-access-check (PR #531)

This PR was submitted for the master branch but it was merged into the 2.1 branch instead (closes #531).

Discussion
----------

fixed access check

allow local link addresses and prevent access when XFF is set (the same as in app_dev.php)

Commits
-------

4c34555 fixed access check: allow local link addresses and prevent access when XFF/HTTP_CLIENT_IP is set