gddo-server: Use 'X-Forwarded-For' to resolve remote address

Change-Id: I6c3b09724d2e808ae36b340496b01ce5a523f0bc
Reviewed-on: https://go-review.googlesource.com/44496
Reviewed-by: Stephen Weinberg <stephenmw@google.com>
diff --git a/gddo-server/main.go b/gddo-server/main.go
index f48b6c1..2e301eb 100644
--- a/gddo-server/main.go
+++ b/gddo-server/main.go
@@ -720,10 +720,8 @@
 
 	// TODO(stephenmw): choose headers based on if we are on App Engine
 	if viper.GetBool(ConfigTrustProxyHeaders) {
-		// If running on GAE, use X-Appengine-User-Ip to identify real ip of requests.
-		if s := req.Header.Get("X-Appengine-User-Ip"); s != "" {
-			req.RemoteAddr = s
-		} else if s := req.Header.Get("X-Real-Ip"); s != "" {
+		// If running on GAE flexible, use X-Forwarded-For to identify real ip of requests.
+		if s := req.Header.Get("X-Forwarded-For"); s != "" {
 			req.RemoteAddr = s
 		}
 	}