Prevent IP spoofing via X-Forwarded-For and Client-IP headers

By specifying the same IP in X-Forwarded-For and Client-IP an attacker is able to easily spoof the value of `request.ip`, unless a trusted proxy is configured to remove any user supplied Client-IP headers. The value of request.ip should be the value after the last trusted proxy IP in X-Forwarded-For (from right to left).
Merge pull request #705 from stevehodgkiss/fix_ip_spoofing_vulnerability

Prevent IP spoofing via X-Forwarded-For and Client-IP headers