[CHANGED] Parse X-FORWARDED-FOR when supplied

Instead of trusting REMOTE_ADDR we should parse X-FORWARDED-FOR if
supplied. This will properly use the user IP in a multi-LB setup.

Needs testing