parse XFF header in remote_ip()

Discussion in #214 highlighted that XFF may contain multiple forwarded
IP address, separated by commas. This patch takes only the first such
address from the list (i.e. the original client's address).