Replace request.ip with X-Real-Ip if it's trusted (useful for Nginx)