fix(proxy): configure trust proxy via TRUST_PROXY env var

Without trust proxy, the rate limiter uses the reverse proxy IP instead
of the real client IP, making all requests appear to come from one IP.
Set TRUST_PROXY=1 in production when behind a single nginx/Apache hop.

src/createApp.js

@@ -10,6 +10,9 @@ const config = require('./config'),
 
 function createApp() {
     const app = express();
+    if (process.env.TRUST_PROXY) {
+        app.set('trust proxy', parseInt(process.env.TRUST_PROXY, 10) || process.env.TRUST_PROXY);
+    }
     app.use(helmet({ contentSecurityPolicy: false }));
     const allowedOrigins = process.env.ALLOWED_ORIGINS
         ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim())