We should not trust `HTTP_*` because these are easy to forge via HTTP headers.