use first component of X-Forwarded-{For,Host,Scheme}

X-Forwarded-{For,Host,Scheme} can contain multiple comma-separated components if there are multiple reverse proxies. Use the first (outer) one.
See http://httpd.apache.org/docs/2.4/mod/mod_proxy.html#x-headers for apache docs.
Enable defense against clickjacking out of the box.
Look in config/galaxy.ini.sample for the option 'x_frame_options' for more information.
Issue session cookies using 'secure' flag for HTTPS requests.
For more information see https://www.owasp.org/index.php/SecureFlag.
Remove unnecessary split on wsgi.url_scheme
change masthead's 'Analyze data' link target to / instead of /root/index for analytics purposes
Merged in jmchilton/galaxy-central-fork-1/next-stable (pull request #573)

Enhanced client security.
ToolForm: Fix optional parameters, add select2 fields, fix style
ToolForm: Allow 1 to n selection for batch mode fields
ToolForm: Adjust batch mode submission
ToolForm: Adjust batch mode for collections
ToolForm: More batch mode validation logic
ToolForm: Handle boolean definition without modifying shared code
Swap webhelpers to use safe dumps.
Fixes security issue 2.2 for regular grid values
Merge