X-FORWARDED-FOR header instead of REMOTE_HOST

[GoogleCodeExporter]

What steps will reproduce the problem?

1. configure auth_token as usual with IP check enabled.

2. try to access one of the protected the pages through any proxy, with the 
token generated for client IP address.

3. you will get "unauthorized", because auth_token is only seeing proxy IP 
address, and does not check "x-forwarded-for" header from the request.

What version of the product are you using? On what operating system?
1.0.6beta on Ubuntu 12.04.1 LTS x64


Please provide any additional information below.

It would be great, if this module can be configured to use any HTTP header in 
authentication, not just "remote_host"

Original issue reported on code.google.com by [email protected] on 20 Sep 2012 at 7:24