use X-forwarded-For header if no remote addr is supplied