log X-Forwarded-For IP instead of remote IP where appropriate

[patrickod]

Currently when deployed behind any sort of load balancing apparatus the logs will display the remote IP of the load balancer in the request logs. Most of these set an extra X-Forwarded-For header which we should log instead as the source of the request.

[nsheridan]

gorilla/handlers#86 looks related