From the mailing list:
The "X-Forwarded-For" header can be a comma-separated list of IP addresses. This happens when Tornado is behind a reverse proxy such as HAProxy. The first IP in the list will be the original client IP, and the last one will be the proxy closest to Tornado.
After this change, this comma-separated list is not considered valid, and so it's discarded. Then remote_ip falls back to the IP of the proxy, which is not what we want.
As a result we have to write our own method to return the IP and use that everywhere. It would be nice if Tornado could handle it, especially to make it easier for others so they don't have to figure out this problem themselves.