Remove x-forwarded-* header support

This should be moved to the middleware layer instead, delegating
`X-Forwarded-For` to `req.ip` and `X-Forwarded-Proto` to `req.secure`.
Update cookie detection

Instead of looking at `req.cookies`, the parser will only detect cookies
set in headers because ultimately that is where middleware originally
grabs the information from. This results in a much simplified logic.
Improve headers detection

koa uses `request.header` as an alias to `req.headers`, while express
inherits `req.headers` from IncomingMessage.