[WIP] - Fix misc findings from reaudit

[jclapis]

Work In Progress

This fixes several smaller miscellaneous findings from the reaudit assessment.

CBST2-01

• Added path / route to the JWT claims to improve resilience against replaying.

CBST2-04

• Added rate-limit flagging to admin route JWT auth checking.
• handle_reload() now updates the state atomically once all of the code has succeeded, and doesn't update it at all if any failures occur.

CBST2-06

• JWT auth checking now retrieves the client IP from the X-Forwarded-For header first, then the X-Real-IP header, then the falls back to the direct connection IP.
• Fixed a race that occurred due to differing locks on JWT auth failure reads and writes.

CBST2-14

• Renamed a misnamed variable.