Dev json xff v0.4

New version based on previous PR #1111.
I guess p_xff - xff_chain would be the len of the leading part, thus bstr_len(h_xff->value) - (p_xff - xff_chain) would be the length of the 2nd (p_xff) part?