If available, use X-Forwarded-For header instead of request.remote_addr for the session protectin id

This fixes #101, added a test for it. Let me know if you are willing to merge this or if you disagree w/the change. Thanks!