Fixing XFF header parsing

There were a few bugs in the old implementation. The largest change was
to decide to return a 403 if the XFF header contained garbage. It is
undetermined if this will be a permanent decision.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>