X-Forwarded-For can be a list.

Since the service is behind Apache, the remote IP is append to that
header. However, if it has already be set, it becomes a list.

This was reported in trac #10190.