use XFF header when present, instead of remote address

lib/AccountManager/App.pm

@@ -462,6 +462,9 @@ sub req_complete_challenge {
         PRE_CHOMP    => CHOMP_ONE,
         INCLUDE_PATH => $templates_dir
     });
+    my $source_ip = $ENV{HTTP_X_FORWARDED_FOR} ?
+        (split(/, /, $ENV{HTTP_X_FORWARDED_FOR}))[0] :
+        $ENV{REMOTE_ADDR};
     my $data = {
         app => {
             url           => $self->{configuration}->{app}->{url},
@@ -469,7 +472,7 @@ sub req_complete_challenge {
             version       => $self->{configuration}->{app}->{version},
             name          => $self->{configuration}->{app}->{name},
         },
-        sourceip  => $ENV{REMOTE_ADDR},
+        sourceip  => $source_ip,
         to        => $email,
         entityid  => $entityid,
         token     => $token->secret(),