Fixed handling of sandbox vs real IPN notifications, in order to prevent a possible spoofing by malicious people with paypal developer accounts (myself included)