Currently, IP spoofing attacks result in a 500 response, which counts
towards our error budget. Since they're caused by the properties of the
client request, it's appropriate to convert them into 400 errors.

We don't need to be too worried about the format of this response, as
only malicious users will see it.