update dependencies
add x-forwarded-for header to the client

This adds the way to find out the actual ip of the client machine, even
if it is hidden behind a local reverse proxy.
use newer rbx stable version for tests