pick up IP from X-Forwarded-for first

The REMOTE_ADDR isn't guaranteed to be the IP of the remote user but is often
the IP of the web server that sits in front of Django. For example, a load
balancer. Instead, the X-FORWARDED-FOR header is usually the IP of the remote
user.