use x-forwarded-for ip, fixes #4