get the proxied IP in request logs

instead of logging the load-balancer IP
handle more cases in failed upstream fetch

- turn 599 (tornado client) errors into 400, 404, not 502
- turn 4XX in 400, not 500
move log_request to nbviewer.log