Where does `req.ip` come from? I'd personally rather not parse this ourselves. It seems like other middleware can do it for us, so we should delegate responsibilities.

In the end, the headers get logged. So if for some reason, the ip address is wrong, a user will see the full `X-Forwarded-For` anyways.