Improves handling of forwarded headers. Fix #2094

Rather than do this, could you:

* Write a method that converts a Configuration into some structure representing the entire configuration (forwarded version, trusted proxies etc), maybe call it `ForwardedConfiguration`.
* Pass `ForwardedConfiguration` into every request that needs it.

We want to try to only access `applicationProvider` once per request (in dev mode, it can be expensive).  There is some work under way that will allow the parsed `ForwardedConfiguration` to only be done once, when the application starts, so you don't have to worry too much about how many times you parse it, we'll fix that up.