Fixed `unforwardIn` function

`unforwardIn` didn't work, because it used to send only the first 13 characters of "cancel-tcpip-forward", which is "cancel-tcpip-". None of the servers understood this.

So I fixed it.


And by the way, when I saw the code, I was a little bit shocked when I saw these things repeating over and over:
```
buf = new Buffer(1 + 4 + 20 + 1 + 4 + addrlen + 4);
buf[0] = MESSAGE.GLOBAL_REQUEST;
buf.writeUInt32BE(20, 1, true);
buf.write('cancel-tcpip-forward', 5, 20, 'ascii');
buf[25] = 1;
buf.writeUInt32BE(addrlen, 26, true);
buf.write(address, 30, addrlen, 'ascii');
buf.writeUInt32BE(port, 30 + addrlen, true);
```
As you can see, this pattern is very error-prone.

Why don't you create a buffer class and then refactor the code like this:
```
buf = new SSHBuffer();
buf.addByte(MESSAGE.GLOBAL_REQUEST);
buf.addUInt32BE(20);
buf.addString('cancel-tcpip-forward');
buf.addByte(1);
buf.addUInt32BE(addrlen);
buf.addString(address);
buf.addUInt32BE(port);
buf = buf.toNodeBuffer();
```

Even OpenSSH implementation, written in pure C has this kind of abstraction.