Check HTTP_X_FORWARDED_FOR when deflecting


add ability to deflect requests from original client IP
…even when it's been forwarded through a proxy.

Use Case:  On Heroku, rack::deflect didn't block
what we wanted because the proxy IP in REMOTE_ADDR
was different for each request during a DOS
we experienced (but the original client IP in
HTTP_X_FORWARDED_FOR was the same).  By patching 
rack-deflect to check the forwarded header first
(and fall back to REMOTE_ADDR if it's not there) 
we were able to deflect it successfully.
i think intent would be more clear with…

```ruby
@remote_addr =
  if env['HTTP_X_FORWARDED_FOR'] && "" != env['HTTP_X_FORWARDED_FOR']
    env['HTTP_X_FORWARDED_FOR']
  else
    env['REMOTE_ADDR']
  end
```