My understanding was, there's actually a lot of headers you can check for IP—HTTP_X_FORWARDED_FOR being the best, but if that doesn't exist, you next want to look at HTTP_CLIENT_IP, HTTP_X_REAL_IP, on down the list until you get to REMOTE_ADDR, which is the least preferred source.

The code in this library isn't especially complicated, but I assumed it'd be safer to rely on the expertise there rather than roll my own IP check and potentially get things wrong.