if X-Forwarded-For header is present, trust it as the IP address of the request