Add in more robust support for being behind a proxy
Fix password reset rate limit to work on ip, not email which changes every request