Check HTTP_X_FORWARDED_FOR when deflecting


add ability to deflect requests from original client IP
…even when it's been forwarded through a proxy.

Use Case:  On Heroku, rack::deflect didn't block
what we wanted because the proxy IP in REMOTE_ADDR
was different for each request during a DOS
we experienced (but the original client IP in
HTTP_X_FORWARDED_FOR was the same).  By patching 
rack-deflect to check the forwarded header first
(and fall back to REMOTE_ADDR if it's not there) 
we were able to deflect it successfully.