Record credit failures

Another step of #2508. Fixes #1811. Built on top of #2579.
> How hard is it to spoof an IP address otherwise?

Spoofing an IP address is not too difficult, but the connections we're receiving are HTTP, which is based on TCP, which uses a three-way handshake, so if you spoof the source address you can't establish the connection, unless you're an active MITM.