If we're behing a proxy such as Caddy, the remote address will be that
of the proxy, so we have to use the X-Forwarded-For header that the
proxy injects instead.

This makes it easier to re-use the session after a while, and to
implement a logout option (by just deleting the session)

It fits the need more naturally.

This makes it easier to deploy the whole thing on FreeBSD

This makes it a bit easier to track things like permissions.

Makes it impossible to see which users have the same password.

... in a very rough fashion