expose additional request fields

remoteaddr for accesslog
headers in security context so we can adapt our session handling to special headers (this is really non-general purpose :()
update copyrights