The rate limiter trusted X-Real-IP, so a client could dodge its limit by sending a new header value on each request. It must key on the connection peer address. The key also strips the port, so one client shares one bucket.
