backend: Make getting requestIP more forgiving

We expect that the xff header will be formatted as ip1, ip2 but there
can be situtations where somebody has a xff as ip1,ip2 and our helper
method just ignores this case.
This patch handles the fundamental mistake with getting requestIP.

cmd/nebraska/controller.go

@@ -826,8 +826,8 @@ func (ctl *controller) processOmahaRequest(c *gin.Context) {
 //
 
 func getRequestIP(r *http.Request) string {
-	ips := strings.Split(r.Header.Get("X-FORWARDED-FOR"), ", ")
-	if ips[0] != "" && net.ParseIP(ips[0]) != nil {
+	ips := strings.Split(r.Header.Get("X-FORWARDED-FOR"), ",")
+	if ips[0] != "" && net.ParseIP(strings.TrimSpace(ips[0])) != nil {
 		return ips[0]
 	}
 	ip, _, _ := net.SplitHostPort(r.RemoteAddr)