[xiaodoudou]

On top of #2. It retargets to master once #2 is merged.

Four fixes, mostly for servers behind a reverse proxy:

• Login could be bypassed. A proxy on the same machine made every visitor look like 127.0.0.1, which is trusted by default, so the login check never applied to them. Trust now follows the visitor's own address (the last X-Forwarded-For / X-Real-IP entry), and login is required again.
• Failed logins are limited per address and per account, answered with Retry-After, and logged. Old entries are dropped.
• Writes and the websocket are refused when they carry the session cookie and the Origin hostname doesn't match the Host.
• The login page sends headers that stop other sites from framing it.