fix(console): a VNC token works only in its user's session; refusals reach the Logs page

The VNC page's token travels in the websocket URL, so nginx's access log
and anyone who saw the URL had it for 120 s, and it opened the console as
a bearer token. novncd now also wants the session cookie of the token's
user. Its refusals were a warning without a user or an address: they now
name the client address (nginx sends X-Real-IP to novncd too) and leave
a Logs row "VNC console refused: reason".

conf/nginx/webvirtcloud.conf

@@ -35,6 +35,7 @@ server {
     location /novncd/ {
         proxy_pass http://wsnovncd;
         proxy_http_version 1.1;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
     }