Record credit failures

Another step of #2508. Fixes #1811. Built on top of #2579.
I've just tested this: the values of `X-Forwarded-For` form a chain, they're joined with commas. Bottom line: we're good, our check still works.