Audited IP needs to be the one originally making the request, not the load balancer's

In the case an application is running behind a load balancer, audited will log all requests's remote_address as if the load balancer made the request, not an individual user.

This trivial patch avoids this and saves the content of the header X-Forwarded-For if the request was made from a load balancer to really know who was originally making the request. If the request does not contain this header (for instance, someone truly making a request directly to your application without load balancers, REMOTE_ADDR is set as the remote_address, which is the only original behavior.