AWS ELB sets the real IP address at the end of ctx.request.ips
We were relying on `ctx.request.ip` to get the real IP which is really just the IP returned in the `X-Forwarded-For` header. Noticed that if we spoofed the header, AWS's ELB would forward it along with the real IP. Multiple spoofed headers were ignored. The most recent spoofed IP and the real IP was always the last IP in an array with 2 values.

```
$ curl -H 'X-Forwarded-For: 1.1.1.1' -H 'X-Forwarded-For: 2.2.2.2' elburl
```
```
X-Forwarded-For: 1.1.1.1,68.32.48.12
```

To correct this behavior we now use the last value in `ctx.request.ips` if it exists, if not, it will use `ctx.request.ip`. This seems to have prevented spoofing IPs with curl.

Reference: [Elastic Load Balancer X-FORWARDED-FOR](https://forums.aws.amazon.com/message.jspa?messageID=160282)