Support X_FORWARDED_FOR header to get IP

My environment doesn't forward REMOTE_ADDR (it's always localhost) but X-Forwarded-For is accurate. This patch allows both.