AMI-422 tell express to use x-forwarded-for for source ip address

PLEASEREVIEW @marrowsmith

Trust proxy to supply non-spoofed x-forwarded-for header, per http://expressjs.com/guide.html#proxies