Prevent IP spoofing via X-Forwarded-For and Client-IP headers

By specifying the same IP in X-Forwarded-For and Client-IP an attacker is able to easily spoof the value of `request.ip`, unless a trusted proxy is configured to remove any user supplied Client-IP headers. The value of request.ip should be the value after the last trusted proxy IP in X-Forwarded-For (from right to left).
Do not truncate POST data on `;`, closes #543

It appears Rack has been doing this for years. It's not correct behavior for any
generators that I can remember. It comes from the cookie parsing code.
ShowException only serves HTML Accept header contains text/html

Rather than be concerned with whether a request is an asynchronous browser
request or not it is better to simply consider the Accept header and only serve
HTML to clients that specifically ask for it.

This way you will not find your pure JSON API application splitting out HTML
error messages to your console when using curl :)
ShowExceptions minor refactoring

* Load HTML exception template only if needed
* Only #call is public
* Enumerable body concern in one place
Restore public API
Undo template refactoring

As this is orthoganol to HTML rendering change.
Flip to best_q_match, so we provide html to */*
correct typo and refactor tests for coverage

Closes #592
Gracefully handle cycles in parameters

Might close 632, pending more information.
Merge pull request #705 from stevehodgkiss/fix_ip_spoofing_vulnerability

Prevent IP spoofing via X-Forwarded-For and Client-IP headers
Fix showexceptions specs on 1.8. Need travis back.
Fix cycle tests on 1.8.7
Fix URI parsing on 1.8.7, also address perf
whitespace
Give @middleware a more semantic name.

Had to put the class method definitions in an eigenclass wrapper
to use the 'alias' keyword sanely. It wouldn't be necessary if
old behavior of the middleware was unsupported, but that would be
too invasive for just a small clarity change.
Simplify default middleware construction.

- Removed concat, the DRYness isn't worth the loss of clarity.
- Removed ||=, no need to memoize such a small operation.
- Removed the array-default hash usage; if this behavior is supported,
  we should add a test for it.
remove incorrect comment in PR 706
Handle params key encoding error.

By changing default encoding to BINARY, allowing arbitrary regexp to pass.