Use X-Forwarded-For header in realtime connections

[davidmz]

We need the real client IP for logging and access control purposes. Unfortunately, it is hard to properly test it, because the websocket connection doesn't allow to specify additional HTTP headers.