Well, so far two VERY contradictory answers. What to do?

Believe them both. The typical web user is not forging or altering their HTTP headers, although in some cases the information may not be terribly useful. But anyone who wants to can easily insert just about any value they like into those fields (potentially even values that pose security threats-- so remember to use taint for added safety). To get a list of every value available to you in a CGI (which will depend on which browser you run this test with), you can run a little script like:

#!/usr/bin/perl -wT
use strict;

my $CGI = new CGI;

print( $CGI->header(),
       $CGI->start_html( -title => 'Save the Environment' ),
       $CGI->h1( 'Here are the $ENV variables I see' )
      );
print $CGI->p( "$_ = $ENV{$_}" ) for ( keys %ENV );
print $CGI->end_html();
[download]

(please note the code above is untested).