bound_cidr_list does not work behind reverse proxy for AppRole

[antimack]

Vault version 0.7.0

Code: 400. Errors:

* failed to validate SecretID: source address "127.0.0.1" unauthorized through CIDR restrictions on the role

Hi, was struggling to make Vault check CIDR restriction behind Nginx reverse proxy but it seems bound_cidr_list does not work behind reverse proxy for AppRole and it's not looking or checking X-Forwarded-For, X-Real-IP in request headers. I checked with tcpdump and X-Forwarded-For, X-Real-IP passed correctly.

This is highly needed in terms of security and running Vault in production.

[vishalnayak]

@antimack Please see the discussions in #291 and #799. This might also be of interest: #1340 (comment).