Better way to obtain the real IP
`app.maxIpsCount` option was [added recently](https://github.com/koajs/koa/commit/422e539e8989e65ba43ecc39ddbaa3c4f755d465#diff-bbd4c3523fd3d17e065d5924f16188aeR119).
But it still has a potential problem because proxies between client and server can be dynamic.
IMO, [`ngx_http_realip_module`](http://nginx.org/en/docs/http/ngx_http_realip_module.html) suggests a better way.
It accepts whitelist and returns the last non-trusted IP.
Please consider implementing a same option in koa.