Cecylia Bocovich authored Aug 12, 2021 and meskio committed Aug 24, 2021

This parses X-Forwarded-For addresses from left to right since with the
domain fronting at moat we may have more than one external proxy
address. getClientIP is also updated to skip not only loopback addresses
but any non-valid address (such as private addresses) that may have been
in the header.