change to forwardedUser

the property in ReverseProxySecurityRealm is called forwardedUser